Schema: Findings

6 fields available

[← Back to Schema Field Reference](schema-field-reference-guide.md)

---

finding.attack_techniques

Array of MITRE ATT&CK technique IDs associated with the finding. NOCSF extension.

Providers: microsoft_defender

---

finding.detection_source

Detection method or engine that produced the finding. NOCSF extension.

Providers: microsoft_defender

---

finding.service_source

Name of the vendor product that generated the finding. NOCSF extension.

Providers: microsoft_defender

---

finding.severity

Numeric severity of the finding (vendor-specific scale). NOCSF extension.

Providers: microsoft_defender,jamf_protect

---

finding.title

Human-readable title or summary of the finding. NOCSF extension.

Providers: microsoft_defender,jamf_protect,falco

---

finding.uid

Vendor-assigned unique identifier for the alert or behavior finding. NOCSF extension.

Providers: microsoft_defender,jamf_protect

---