Source types

The Splunk Add-on for Microsoft Security assigns the following source types and Common Information Model (CIM) data models:

Source type	Data	CIM data models
ms:defender:atp:alerts	Microsoft Defender for Endpoint alerts	Alerts
ms365:defender:incident	Microsoft Defender XDR incidents	Ticket Management
ms365:defender:incident:alerts	Alerts associated with Microsoft Defender XDR incidents	Alerts
m365:defender:incident:advanced_hunting	Results returned by the Defender Advanced Hunting alert action	Authentication, Email, Endpoint, Network Traffic
ms:defender:simulations	Microsoft Defender attack simulation reports	Alerts
ms:defender:eventhub	Microsoft Defender XDR streaming events collected from Azure Event Hubs	Alerts, Authentication, Certificates, Email, Endpoint, Inventory, Network Traffic, Web
ms:defender:machines	Microsoft Defender for Endpoint machine inventory	Inventory
ms:defender:ti:articles	Microsoft Defender Threat Intelligence articles	None
ms:defender:ti:article_indicators	Indicators associated with threat intelligence articles	None
ms:defender:ti:certificates	Host certificate intelligence	None
ms:defender:ti:components	Host component intelligence	None
ms:defender:ti:cookies	Host cookie intelligence	None
ms:defender:ti:hostpairs	Host-pair intelligence	None
ms:defender:ti:passivedns	Passive DNS intelligence	None
ms:defender:ti:subdomains	Host subdomain intelligence	None
ms:defender:ti:trackers	Host tracker intelligence	None
ms:defender:ti:whois	WHOIS intelligence	None

For details about the data models, datasets, and fields, see the Splunk Common Information Model documentation.

Duplicate incident-alert events

The ms365:defender:incident:alerts source type can contain multiple events for the same alert. This behavior occurs because Microsoft Defender XDR returns the alerts associated with an incident whenever that incident is retrieved again.

For example, when the status of an incident changes but its associated alerts do not change, the add-on indexes the updated incident in ms365:defender:incident and indexes the returned associated alerts again in ms365:defender:incident:alerts.

Use stable Microsoft identifiers and the event time when you deduplicate alert events in searches. Do not assume that repeated collection means the alert itself changed.

Duplicate threat intelligence events

The ms:defender:ti:* source types can contain duplicate events when the Microsoft Defender Threat Intelligence API returns the same dataset object in more than one collection cycle. Use the identifiers supplied by Microsoft when you deduplicate these events.