Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Siem agent IPv6 Field label inconsistency

Deleted
Not applicable

Hi all

 

Using the siem agent with mcas, most of the fields labels have no spaces:

 

cs1Label=portalURL

cs2Label=uniqueServiceAppIds

cs3Label=targetObjects

cs4Label=policyIDs

 

Why did MS decide to give this one spaces and quotes?

c6a1Label="Device IPv6 Address"

 

We will modify our siem parsing to work-around this but it is an unnecessary hassle. There are examples in the docs here:

https://docs.microsoft.com/en-us/cloud-app-security/siem#sample-activity-logs

 

Regards

J

 

0 Replies