|
| 1 | +--- |
| 2 | +title: DataSecurityEvents table in the advanced hunting schema |
| 3 | +description: Learn about the DataSecurityEvents table of the advanced hunting schema, which contains information about user activities that violate user-defined or default policies in the Microsoft Purview suite of solutions. |
| 4 | +ms.service: defender-xdr |
| 5 | +ms.subservice: adv-hunting |
| 6 | +f1.keywords: |
| 7 | + - NOCSH |
| 8 | +ms.author: maccruz |
| 9 | +author: schmurky |
| 10 | +ms.localizationpriority: medium |
| 11 | +manager: dansimp |
| 12 | +audience: ITPro |
| 13 | +ms.collection: |
| 14 | +- m365-security |
| 15 | +- tier3 |
| 16 | +ms.custom: |
| 17 | +- cx-ti |
| 18 | +- cx-ah |
| 19 | +ms.topic: reference |
| 20 | +ms.date: 02/11/2025 |
| 21 | +--- |
| 22 | + |
| 23 | +# DataSecurityEvents (Preview) |
| 24 | + |
| 25 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)] |
| 26 | + |
| 27 | +**Applies to:** |
| 28 | + |
| 29 | +- Microsoft Defender XDR |
| 30 | +- Microsoft Purview |
| 31 | + |
| 32 | + |
| 33 | + |
| 34 | +> [!IMPORTANT] |
| 35 | +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. |
| 36 | +
|
| 37 | +The `DataSecurityEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user activities that violate user-defined or default policies in the Microsoft Purview suite of solutions. Each log represents a single user activity enriched with proprietary Microsoft detections (like sensitive info types) and user-defined enrichment labels like domain categories, sensitivity labels, and others. |
| 38 | + |
| 39 | +Use this reference to construct queries that return information from this table. |
| 40 | + |
| 41 | +For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md). |
| 42 | + |
| 43 | +| Column name | Data type | Description | |
| 44 | +|-------------|-----------|-------------| |
| 45 | +|`ApplicationNames`| `string`|List of application names used or related to the event| |
| 46 | +|`DeviceId`| `string`| Unique identifier for the device in Microsoft Defender for Endpoint| |
| 47 | +|`DeviceName`| `string`| Fully qualified domain name(FQDN) of the device| |
| 48 | +|`AadDeviceId`| `guid`| Unique identifier for the device in Microsoft Entra ID| |
| 49 | +|`IsManagedDevice`| `bool`| Indicates if the device is managed by the organization (True) or not (False)| |
| 50 | +|`DlpPolicyMatchInfo`| `string`| Information around the list of data loss prevention (DLP) policies matching this event| |
| 51 | +|`DlpPolicyEnforcementMode`| `int`| Indicates the Data Loss Prevention policy that was enforced; value can be: 0 (None), 1 (Audit), 2 (Warn), 3 (Warn and bypass), 4 (Block), 5 (Allow)| |
| 52 | +|`DlpPolicyRuleMatchInfo`| `dynamic`| Details of the data loss prevention (DLP) rules that matched with this event; in JSON array format| |
| 53 | +|`FileRenameInfo`|`string`| Details of the file (file name and extension) prior to this event| |
| 54 | +|`PhysicalAccessPointId`| `string`| Unique identifier for the physical access point| |
| 55 | +|`PhysicalAccessPointName`| `string`| Name of the physical access point| |
| 56 | +|`PhysicalAccessStatus` |`string`| Status of physical access, whether it succeeded or failed| |
| 57 | +|`PhysicalAssetTag`|`string` |Tag assigned to the asset as configured in Microsoft Insider Risk Management global settings| |
| 58 | +|`RemovableMediaManufacturer`|`string`| Manufacturer name of the removable device| |
| 59 | +|`RemovableMediaModel`| `string`| Model name of the removable device| |
| 60 | +|`RemovableMediaSerialNumber`| `string`|Serial number of the removable device| |
| 61 | +|`TeamsChannelName`|`string`| Name of the Teams channel| |
| 62 | +|`TeamsChannelType`| `string`| Type of the Teams channel| |
| 63 | +|`TeamsTeamName`| `string` |Name of the Teams team | |
| 64 | +|`UserAlternateEmails`| `string`| Alternate emails or aliases of the user| |
| 65 | +|`AccountUpn`| `string`| User principal name (UPN) of the account| |
| 66 | +|`AccountObjectId`| `string`| Unique identifier for the account in Microsoft Entra ID| |
| 67 | +|`Department`|`string`| Name of the department that the account user belongs to| |
| 68 | +|`SourceCodeInfo`| `string`| Details of the source code repository involved in the event| |
| 69 | +|`CcPolicyMatchInfo`| `dynamic` | Details of the Communications Compliance policy matches for this event; in JSON array format | |
| 70 | +|`IPAddress`| `string`| IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts| |
| 71 | +|`Timestamp`| `datetime`| Date and time when the event was recorded| |
| 72 | +|`DeviceSourceLocationType`| `int`| Indicates the type of location where the endpoint signals originated from; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)| |
| 73 | +|`DeviceDestinationLocationType`| `int`| Indicates the type of location where the endpoint signals connected to; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)| |
| 74 | +|`IrmPolicyMatchInfo`| `dynamic`| Details of Insider Risk Management policy matches for the content involved in the event; in JSON array format | |
| 75 | +|`UnallowedUrlDomains`| `string`| Websites or service URLs involved in this event that is configured as Unallowed in Insider Risk Management global settings| |
| 76 | +|`ExternalUrlDomains`| `string`| Websites or service URLs involved in this event that is classified as External in Insider Risk Management global settings| |
| 77 | +|`UrlDomainInfo`| `string`| Details about the websites or service URLs involved in the event| |
| 78 | +|`SourceUrlDomain`| `string`| Domain where the device and email signals originated| |
| 79 | +|`TargetUrlDomain`| `string`| Domain where the content was shared with or the user has browsed to| |
| 80 | +|`EmailAttachmentCount`|`int`| Number of email attachments | |
| 81 | +|`EmailAttachmentInfo`| `dynamic`| Details of email attachments; in JSON array format| |
| 82 | +|`InternetMessageId`|`string` |Public-facing identifier for the email or Teams message that is set by the sending email system | |
| 83 | +|`NetworkMessageId`| `guid`| Unique identifier for the email, generated by Microsoft 365 | |
| 84 | +|`EmailSubject`| `string`| Subject of the email| |
| 85 | +|`ObjectId`| `string` |Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension| |
| 86 | +|`ObjectName`| `string`| Name of the object that the recorded action was applied to, in case of files it includes the extension| |
| 87 | +|`ObjectType`| `string`| Type of object, such as a file or a folder, that the recorded action was applied to| |
| 88 | +|`ObjectSize`| `int`| Size of the object in bytes| |
| 89 | +|`IsHidden`| `bool`| Indicates whether the user has marked the content as hidden (True) or not (False) | |
| 90 | +|`ActivityId` |`guid`| Unique identifier of the activity log| |
| 91 | +|`ActionType`|`string`| Type of activity that triggered the event| |
| 92 | +|`SensitiveInfoTypeInfo`| `dynamic`| Details of Data Loss Prevention sensitive info types detected in the impacted asset| |
| 93 | +|`SensitivityLabelId`|`string`|The current Microsoft Information Protection sensitivity label ID associated with the item| |
| 94 | +|`SharepointSiteSensitivityLabelIds`|`string`| The current Microsoft Information Protection sensitivity label ID assigned to the parent site of the item related to SharePoint activities | |
| 95 | +|`PreviousSensitivityLabelId`| `string`|The previous Microsoft Information Protection sensitivity label ID associated with the item in case of activities where the sensitivity label was changed| |
| 96 | +|`Operation`| `string`| Name of the admin activity| |
| 97 | +|`RecipientEmailAddress`| `string`| Email address of the recipient, or email address of the recipient after distribution list expansion| |
| 98 | +|`SiteUrl`| `string` | The URL of the site where the file or folder accessed by the user is located | |
| 99 | +|`SourceRelativeUrl`| `string`| The URL of the folder that contains the file accessed by the user | |
| 100 | +|`TargetFilePath`| `string`| Target file path of endpoint activities| |
| 101 | +|`PrinterName`| `string`| List of printers involved in the behavior| |
| 102 | +|`Workload`|`string`| The Microsoft 365 service where the event occurred| |
| 103 | +|`IrmActionCategory`| `enum`| A unique enumeration value indicating the activity category in Microsoft Purview Insider Risk Management| |
| 104 | +|`SequenceCorrelationId`|`string` |Details of the sequence activity| |
| 105 | + |
| 106 | + |
| 107 | +## Related articles |
| 108 | + |
| 109 | +- [Advanced hunting overview](advanced-hunting-overview.md) |
| 110 | +- [Learn the query language](advanced-hunting-query-language.md) |
| 111 | +- [Use shared queries](advanced-hunting-shared-queries.md) |
| 112 | +- [Understand the schema](advanced-hunting-schema-tables.md) |
| 113 | +- [Apply query best practices](advanced-hunting-best-practices.md) |
| 114 | + |
| 115 | + |
| 116 | +[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)] |
0 commit comments