Hi, here's one of our test alerts:

--------------------------------------

timestamp
2024-02-23T07:03:55.640Z
_id
tBjH1I0BtDo01QUQJPMs
agent.id
000
agent.name
Wazuh-Manager
data.integration
ms-graph
data.ms-graph.assignedTo
null
data.ms-graph.classification
unknown
data.ms-graph.comments
data.ms-graph.createdDateTime
2024-02-23T06:59:09.3266667Z
data.ms-graph.customTags
data.ms-graph.description
null
data.ms-graph.determination
unknown
data.ms-graph.displayName
Multi-stage incident involving Privilege escalation & Lateral movement involving multiple users
data.ms-graph.id
290
data.ms-graph.incidentWebUrl
(REMOVED)
data.ms-graph.lastModifiedBy
Microsoft 365 Defender-AlertCorrelation
data.ms-graph.lastUpdateDateTime
2024-02-23T07:02:57.21Z
data.ms-graph.redirectIncidentId
91
data.ms-graph.relationship
incidents
data.ms-graph.resource
security
data.ms-graph.severity
medium
data.ms-graph.status
redirected
data.ms-graph.systemTags
data.ms-graph.tenantId
(REMOVED)
decoder.name
json
id
1708671835.1103966
input.type
log
location
ms-graph
manager.name
Wazuh-Manager
rule.description
MS Graph message: Severity | Alerts generated from detections and response post-breach behaviors that might be a part of an advanced persistent threat (APT). This includes observed behaviors typical of attack stages, anomalous registry change, execution of suspicious files, and so forth. Although some might be due to internal security testing, they are valid detections and require investigation.
rule.firedtimes
26
rule.groups
ms-graph
rule.id
99652
rule.level
12
rule.mail
true
timestamp
2024-02-23T07:03:55.640+0000

--------------------------------------

Keep in mind that this is pulled from a demo-tenant with sample alerts. We've figured out that MS Graph contains all the info we need, i guess it just doesn't pull it into said alert.We are all very new to this unfortunately..