AnomalyEvidence

Properties

Name	Type	Description	Notes
Source	String	Evidence source system.	[optional]
Timestamp	AnomalyEvidenceTimestamp		[optional]
AgentAttributeType	String	Attribute type captured for SENTINEL detections; null for SIEM detections.	[optional]
AgentAttributeValue	String	Attribute value captured for SENTINEL detections; null for SIEM detections.	[optional]
Baseline	AnomalyBaseline	Peer-group baseline for SIEM detections; null for SENTINEL detections.	[optional]

Examples

• Prepare the resource

$AnomalyEvidence = Initialize-AnomalyEvidence  -Source SENTINEL `
 -Timestamp null `
 -AgentAttributeType shell_exec `
 -AgentAttributeValue curl external.example.com `
 -Baseline null

• Convert the resource to JSON

$AnomalyEvidence | ConvertTo-JSON

[Back to top]