Skip to main content

Platform Field Mapping

This page defines the minimum field mapping needed before a hunt starter can be treated as a platform-specific analytic. It is intentionally conservative: a query is not production-ready just because a concept exists in Sigma or KQL.

Microsoft Defender XDR / Sentinel​

Use CasePrimary TablesRequired Fields
Mail click to executionEmailEvents, UrlClickEvents, DeviceProcessEvents, SigninLogsTimestamp / TimeGenerated, RecipientEmailAddress, Url, AccountUpn, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
RMM abuseDeviceProcessEvents, DeviceFileEvents, DeviceNetworkEventsDeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, RemoteUrl, RemoteIP
Identity-plane destructionAuditLogs, CloudAppEvents, Intune audit tables where availableOperationName, InitiatedBy, TargetResources, Result, IPAddress, UserAgent
DNS tunnelingDeviceEvents, DNS server logs, resolver logsDnsQueryName, DnsQueryType, DeviceName, InitiatingProcessFileName, RemoteUrl, query count

Splunk​

Use CaseLikely Index / SourcetypeRequired Fields
Windows process rulesSysmon, Windows Security, EDR sourcetypesprocess_name, process, parent_process_name, dest, user, signature_status
Webshell post-exploitationIIS, Exchange, EDR, web proxycs_uri_stem, cs_user_agent, process_name, parent_process_name, file_path, src_ip
OT exposureFirewall, proxy, OT NDRsrc_ip, dest_ip, dest_port, url, action, asset_owner

Elastic​

Use CaseECS Fields
Process executionprocess.name, process.command_line, process.parent.name, host.name, user.name
Network connectiondestination.ip, destination.port, dns.question.name, url.domain, process.name
File changesfile.path, file.name, event.action, process.name, host.name

Promotion Requirements​

Before moving from hunt starter to pilot:

  • confirm the table/index exists in the target environment;
  • confirm all required fields are populated;
  • define environment-specific allowlists;
  • run one positive test or replay;
  • run one negative test or benign baseline review;
  • record the result in the detection health register.

References​