https://community.splunk.com/t5/Security/CIM-mapping-tags-forMicrosoft-Graph-Security/m-p/678031#M17611 <P>Hello,&nbsp;</P><P>looks like Microsoft Graph Security add all tags to all event type so its not correctly CIM mapped , any one filtered events based on alerts data&nbsp; and map to correct data models?&nbsp;</P><P>for example i need to sort out based on events and map to below data models</P><P><SPAN>Malware - IDS - Endpoint - Alert</SPAN></P><P>Thx&nbsp;</P> Tue, 20 Feb 2024 00:56:12 GMT Splunk_rocks 2024-02-20T00:56:12Z https://community.splunk.com/t5/Security/CIM-mapping-tags-forMicrosoft-Graph-Security/m-p/678031#M17611 <P>Hello,&nbsp;</P><P>looks like Microsoft Graph Security add all tags to all event type so its not correctly CIM mapped , any one filtered events based on alerts data&nbsp; and map to correct data models?&nbsp;</P><P>for example i need to sort out based on events and map to below data models</P><P><SPAN>Malware - IDS - Endpoint - Alert</SPAN></P><P>Thx&nbsp;</P> Tue, 20 Feb 2024 00:56:12 GMT https://community.splunk.com/t5/Security/CIM-mapping-tags-forMicrosoft-Graph-Security/m-p/678031#M17611 Splunk_rocks 2024-02-20T00:56:12Z