Using the siem agent with mcas, most of the fields labels have no spaces:
Why did MS decide to give this one spaces and quotes?
c6a1Label="Device IPv6 Address"
We will modify our siem parsing to work-around this but it is an unnecessary hassle. There are examples in the docs here: