Skip to content

Commit 011df5e

Browse files
committed
Update docs with new ms.date and schema change notes
Updated the ms.date metadata in two documentation files to 11/27/2025. Removed example Kusto queries and explanatory text from advanced-hunting-schema-changes.md regarding Boolean field value changes, streamlining the November 2025 schema change notes.
1 parent 8f206b1 commit 011df5e

File tree

2 files changed

+2
-17
lines changed

2 files changed

+2
-17
lines changed

defender-xdr/advanced-hunting-devicetvmsecureconfigurationassessment-table.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ appliesto:
2121
- Microsoft Defender XDR
2222
- Microsoft Sentinel in the Microsoft Defender portal
2323
ms.topic: reference
24-
ms.date: 03/28/2025
24+
ms.date: 11/27/2025
2525
---
2626

2727
# DeviceTvmSecureConfigurationAssessment

defender-xdr/advanced-hunting-schema-changes.md

Lines changed: 1 addition & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ appliesto:
2121
- Microsoft Defender XDR
2222
- Microsoft Sentinel in the Microsoft Defender portal
2323
ms.topic: reference
24-
ms.date: 11/04/2025
24+
ms.date: 11/27/2025
2525
---
2626

2727
# Advanced hunting schema - Naming changes
@@ -40,21 +40,6 @@ Naming changes are automatically applied to queries that are saved in Microsoft
4040
## November 2025
4141
- The Boolean field values in advanced hunting results will change from numeric (`1` and `0`) to textual (`True` and `False`) on January 25, 2026. While your queries and custom detection rules won't be affected by this change, you might want to update your automated processes (for example, scripts, playbooks, or integrations) parsing these values.
4242

43-
For example:
44-
45-
**Current behavior**
46-
```kusto
47-
DeviceEvents
48-
| where IsAdmin == 1
49-
```
50-
51-
**Future behavior**
52-
```kusto
53-
DeviceEvents
54-
| where IsAdmin == true
55-
```
56-
57-
Both queries will remain valid. However, if your automation expects `IsAdmin=1` in the output, update it to accept `true` instead.
5843

5944
- The [`AADSignInEventsBeta`](advanced-hunting-aadsignineventsbeta-table.md) and [`AADSpnSignInEventsBeta`](advanced-hunting-aadspnsignineventsbeta-table.md) tables are being replaced by [`EntraIdSignInEvents`](advanced-hunting-entraidsigninevents-table.md) and [`EntraIdSpnSignInEvents`](advanced-hunting-entraidspnsigninevents-table.md), respectively. These changes are being made to remove the former tables' preview status and to align them with the existing product branding.
6045

0 commit comments

Comments
 (0)