Defender-AlertInfo
| ActionType | Title | Sample | Rule |
|---|---|---|---|
| any | Alert information | Y | Y |
any: Alert information
#Fields #
| Name | Description |
|---|---|
Timestamp | |
AlertId | |
Title | |
Category | |
Severity | |
ServiceSource | |
DetectionSource | |
AttackTechniques | |
MachineGroup |
Example Event #
{
"AlertId": "da90e6fe47-4ecb-4cfd-abd5-826bc671bae6_1",
"AttackTechniques": [
"Masquerading (T1036)",
"Masquerade Task or Service (T1036.004)",
"Windows Service (T1543.003)",
"Service Execution (T1569.002)",
"Services Registry Permissions Weakness (T1574.011)"
],
"Category": "Persistence",
"DetectionSource": "EDR",
"ServiceSource": "Microsoft Defender for Endpoint",
"Severity": "Medium",
"Timestamp": "2026-08-01T02:22:14.8885692Z",
"Title": "Suspicious service registration"
}