---
title: "casb.microsoft_defender"
canonical: "https://docs.devo.com/space/latest/207388731/casb.microsoft_defender"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `casb.microsoft`** **identify events generated by [Microsoft Defender](https://www.microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals).

## Valid tags and data tables

The full tag must have 4 levels. The first two are fixed as** **`casb.microsoft`. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Microsoft Defender | `casb.microsoft_defender.cloud_apps.activities` | `casb.microsoft_defender.cloud_apps.activities` |
| `casb.microsoft_defender.cloud_apps.alerts` | `casb.microsoft_defender.cloud_apps.alerts` |
| `casb.microsoft_defender.cloud_apps.data_enrichement` | `casb.microsoft_defender.cloud_apps.data_enrichement` |
| `casb.microsoft_defender.cloud_apps.entities` | `asb.microsoft_defender.cloud_apps.entities` |
| `casb.microsoft_defender.cloud_apps.files` | `casb.microsoft_defender.cloud_apps.files` |

## Table structure

This is the set displayed by these tables. 

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [casb.microsoft_defender.cloud_apps.activities](#)
> - [casb.microsoft_defender.cloud_apps.alerts](#casb.microsoft_defender.cloud_apps.alerts)
> - [casb.microsoft_defender.cloud_apps.data_enrichment](#)
> 
> ### > Macro (anchor)
> 
> casb.microsoft_defender.cloud_apps.activities
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *tenantId* | `int8` |  |
> | *appId* | `int4` |  |
> | *saasId* | `int4` |  |
> | *timestamp* | `timestamp` |  |
> | *created* | `timestamp` |  |
> | *eventType* | `int4` |  |
> | *eventTypeValue* | `str` |  |
> | *eventRouting__scubaUnpacker* | `bool` |  |
> | *eventRouting__auditing* | `bool` |  |
> | *eventRouting__portalEvent* | `bool` |  |
> | *device__clientIP* | `ip4` |  |
> | *device__userAgent* | `str` |  |
> | *device__countryCode* | `str` |  |
> | *location__countryCode* | `str` |  |
> | *location__city* | `str` |  |
> | *location__postalCode* | `str` |  |
> | *location__region* | `str` |  |
> | *location__longitude* | `float8` |  |
> | *location__latitude* | `float8` |  |
> | *location__organizationSearchable* | `str` |  |
> | *location__anonymousProxy* | `bool` |  |
> | *location__isSatelliteProvider* | `bool` |  |
> | *location__category* | `int4` |  |
> | *location__categoryValue* | `str` |  |
> | *location__carrier* | `str` |  |
> | *location__isHostingFacility* | `bool` |  |
> | *user__userName* | `str` |  |
> | *userAgent__family* | `str` |  |
> | *userAgent__name* | `str` |  |
> | *userAgent__operatingSystem__name* | `str` |  |
> | *userAgent__operatingSystem__family* | `str` |  |
> | *userAgent__type* | `str` |  |
> | *userAgent__typeName* | `str` |  |
> | *userAgent__version* | `str` |  |
> | *userAgent__major* | `str` |  |
> | *userAgent__minor* | `str` |  |
> | *userAgent__deviceType* | `str` |  |
> | *userAgent__nativeBrowser* | `bool` |  |
> | *userAgent__os* | `str` |  |
> | *userAgent__browser* | `str` |  |
> | *mainInfo__eventObjects* | `str` |  |
> | *mainInfo__activityResult__isSuccess* | `bool` |  |
> | *mainInfo__rawOperationName* | `str` |  |
> | *mainInfo__prettyOperationName* | `str` |  |
> | *mainInfo__type* | `str` |  |
> | *confidenceLevel* | `int4` |  |
> | *session__sessionId* | `str` |  |
> | *resolvedActor__id* | `str` |  |
> | *resolvedActor__saasId* | `str` |  |
> | *resolvedActor__instanceId* | `str` |  |
> | *resolvedActor__tags* | `str` |  |
> | *resolvedActor__role* | `str` |  |
> | *resolvedActor__governable* | `bool` |  |
> | *uid* | `str` |  |
> | *appName* | `str` |  |
> | *matchingRules* | `str` |  |
> | *eventTypeName* | `str` |  |
> | *classifications* | `str` |  |
> | *entityData* | `str` |  |
> | *description_id* | `str` |  |
> | *description_metadata__event_category* | `str` |  |
> | *description_metadata__colon* | `str` |  |
> | *description_metadata__dash* | `str` |  |
> | *description* | `str` |  |
> | *genericEventType* | `str` |  |
> | *severity* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.microsoft_defender.cloud_apps.alerts
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *timestamp* | `timestamp` |  |
> | *entity_type* | `str` |  |
> | *entity_label* | `str` |  |
> | *entity_id* | `str` |  |
> | *entity_policySubType* | `str` |  |
> | *entity_policyType* | `str` |  |
> | *audits* | `str` |  |
> | *title* | `str` |  |
> | *description* | `str` |  |
> | *stories* | `str` |  |
> | *policy__type* | `str` |  |
> | *policy__label* | `str` |  |
> | *policy__id* | `str` |  |
> | *policy__policySubType* | `str` |  |
> | *policy__policyType* | `str` |  |
> | *contextId* | `str` |  |
> | *threatScore* | `int4` |  |
> | *threatScoreReasoning* | `str` |  |
> | *intent* | `str` |  |
> | *idValue* | `int8` |  |
> | *statusValue* | `int4` |  |
> | *severityValue* | `int4` |  |
> | *resolutionStatusValue* | `int4` |  |
> | *isSystemAlert* | `bool` |  |
> | *URL* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.microsoft_defender.cloud_apps.data_enrichment
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *id* | `str` |  |
> | *name* | `str` |  |
> | *subnets* | `str` |  |
> | *location__name* | `str` |  |
> | *location__latitude* | `float8` |  |
> | *location__longitude* | `float8` |  |
> | *location__countryCode* | `str` |  |
> | *location__countryName* | `str` |  |
> | *organization* | `str` |  |
> | *tags* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> > Macro (rw-tab)
> 
> - [casb.microsoft_defender.cloud_apps.entities](#casb.microsoft_defender.cloud_apps.entities)
> - [casb.microsoft_defender.cloud_apps.files](#casb.microsoft_defender.cloud_apps.files)
> 
> ### > Macro (anchor)
> 
> casb.microsoft_defender.cloud_apps.entities
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *type* | `int4` |  |
> | *status* | `str` |  |
> | *displayName* | `str` |  |
> | *id* | `str` |  |
> | *_id* | `str` |  |
> | *userGroups* | `str` |  |
> | *identifiers* | `str` |  |
> | *sid* | `str` |  |
> | *appData__appId* | `int4` |  |
> | *appData__name* | `str` |  |
> | *appData__saas* | `int4` |  |
> | *appData__instance* | `int4` |  |
> | *isAdmin* | `bool` |  |
> | *isExternal* | `bool` |  |
> | *email* | `str` |  |
> | *role* | `str` |  |
> | *organization* | `str` |  |
> | *domain* | `str` |  |
> | *scoreTrends* | `str` |  |
> | *subApps* | `str` |  |
> | *threatScore* | `str` |  |
> | *idType* | `int4` |  |
> | *isFake* | `bool` |  |
> | *ii* | `str` |  |
> | *actions* | `str` |  |
> | *username* | `str` |  |
> | *sctime* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> casb.microsoft_defender.cloud_apps.files
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *_id* | `str` |  |
> | *tid* | `int8` |  |
> | *appId* | `int8` |  |
> | *id* | `str` |  |
> | *collaborators* | `str` |  |
> | *domains* | `str` |  |
> | *driveId* | `str` |  |
> | *emails* | `str` |  |
> | *externalShares* | `str` |  |
> | *facl* | `int4` |  |
> | *fileAccessLevel* | `str` |  |
> | *fileExtension* | `str` |  |
> | *fileSize* | `int4` |  |
> | *fileStatus* | `str` |  |
> | *fileType* | `str` |  |
> | *fstat* | `int4` |  |
> | *ftype* | `int4` |  |
> | *groupIds* | `str` |  |
> | *groups* | `str` |  |
> | *hash* | `str` |  |
> | *instId* | `int4` |  |
> | *isFolder* | `bool` |  |
> | *isForeign* | `bool` |  |
> | *isTeamFolder* | `bool` |  |
> | *lastFileTableSnapshotModification* | `timestamp` |  |
> | *lastNrtSwTimestamp* | `timestamp` |  |
> | *lastNrtTimestamp* | `timestamp` |  |
> | *mimeType* | `str` |  |
> | *modifiedDate* | `timestamp` |  |
> | *name* | `str` |  |
> | *name_l* | `str` |  |
> | *noGovernance* | `bool` |  |
> | *ownerAddress* | `str` |  |
> | *ownerExternal* | `bool` |  |
> | *ownerId* | `str` |  |
> | *ownerName* | `str` |  |
> | *parentIds* | `str` |  |
> | *path* | `str` |  |
> | *prvNrtTimestamp* | `int4` |  |
> | *saasId* | `int4` |  |
> | *scanVersion* | `int4` |  |
> | *snapshotLastModifiedDate* | `timestamp` |  |
> | *unseenScans* | `int4` |  |
> | *shouldScanDlp* | `str` |  |
> | *dlpContentScanResults* | `str` |  |
> | *dlpScanCompletionStatus* | `int4` |  |
> | *dlpScanCompletionStatusV2__adallom__status* | `int4` |  |
> | *dlpScanCompletionStatusV2__adallom__time* | `timestamp` |  |
> | *dlpScanTime* | `timestamp` |  |
> | *scannedDlp* | `str` |  |
> | *effectiveParents* | `str` |  |
> | *originalId* | `str` |  |
> | *dlpScanResults* | `str` |  |
> | *fTags* | `str` |  |
> | *enriched* | `bool` |  |
> | *display_collaborators* | `str` |  |
> | *appName* | `str` |  |
> | *actions* | `str` |  |
> | *at_devo_pulling_id* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |