Skip to content

Commit 0bc8783

Browse files
committed
Update advanced hunting docs and table descriptions
Updated ms.date fields to 12/04/2025 in several Defender XDR documentation files. Clarified the description of the FileMaliciousContentInfo table to indicate it covers files processed, not just those identified as malicious, in both the schema tables and what's new documentation.
1 parent 0238cd4 commit 0bc8783

File tree

4 files changed

+6
-6
lines changed

4 files changed

+6
-6
lines changed

defender-xdr/advanced-hunting-campaigninfo-table.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ appliesto:
2121
- Microsoft Defender XDR
2222
- Microsoft Sentinel in the Microsoft Defender portal
2323
ms.topic: reference
24-
ms.date: 12/01/2025
24+
ms.date: 12/04/2025
2525
---
2626

2727
# CampaignInfo (Preview)

defender-xdr/advanced-hunting-filemaliciouscontentinfo-table.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ appliesto:
2121
- Microsoft Defender XDR
2222
- Microsoft Sentinel in the Microsoft Defender portal
2323
ms.topic: reference
24-
ms.date: 12/01/2025
24+
ms.date: 12/04/2025
2525
---
2626

2727
# FileMaliciousContentInfo (Preview)

defender-xdr/advanced-hunting-schema-tables.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ appliesto:
2121
- Microsoft Defender XDR
2222
- Microsoft Sentinel in the Microsoft Defender portal
2323
ms.topic: reference
24-
ms.date: 11/17/2025
24+
ms.date: 12/04/2025
2525
---
2626

2727
# Understand the advanced hunting schema
@@ -102,7 +102,7 @@ The following reference lists all the tables in the schema. Each table name link
102102
| **[EntraIdSpnSignInEvents](advanced-hunting-entraidspnsigninevents-table.md)** (Preview)| Microsoft Entra service principal and managed identity sign-ins |
103103
| **[ExposureGraphEdges](advanced-hunting-exposuregraphedges-table.md)** | Microsoft Security Exposure Management exposure graph edge information provides visibility into relationships between entities and assets in the graph |
104104
| **[ExposureGraphNodes](advanced-hunting-exposuregraphnodes-table.md)** | Microsoft Security Exposure Management exposure graph node information, about organizational entities and their properties |
105-
| **[FileMaliciousContentInfo](advanced-hunting-emailurlinfo-table.md)** (Preview) | Files that were identified as malicious by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams |
105+
| **[FileMaliciousContentInfo](advanced-hunting-emailurlinfo-table.md)** (Preview) | Files that were processed by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams. |
106106
| **[GraphApiAuditEvents](advanced-hunting-graphapiauditevents-table.md)** (Preview) | Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant |
107107
| **[IdentityAccountInfo](advanced-hunting-identityaccountinfo-table.md)** (Preview) | Account information from various sources, including Microsoft Entra ID. This table also includes information and link to the identity that owns the account. |
108108
| **[IdentityDirectoryEvents](advanced-hunting-identitydirectoryevents-table.md)** | Events involving an on-premises domain controller running Active Directory (AD). This table covers a range of identity-related events and system events on the domain controller. |

defender-xdr/whats-new.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.service: defender-xdr
66
ms.author: guywild
77
author: guywi-ms
88
ms.localizationpriority: medium
9-
ms.date: 12/01/2025
9+
ms.date: 12/04/2025
1010
manager: deniseb
1111
audience: ITPro
1212
ms.collection:
@@ -35,7 +35,7 @@ You can also get product updates and important notifications through the [messag
3535
## December 2025
3636
- (Preview) The following advanced hunting schema tables are now available for preview:
3737
- The [`CampaignInfo`](advanced-hunting-campaigninfo-table.md) table contains contains information about email campaigns identified by Microsoft Defender for Office 365
38-
- The [`FileMaliciousContentInfo`](advanced-hunting-filemaliciouscontentinfo-table.md) table contains information about files that were identified as malicious by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams
38+
- The [`FileMaliciousContentInfo`](advanced-hunting-filemaliciouscontentinfo-table.md) table contains information about files that were processed by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams
3939
- (GA) The [hunting graph](advanced-hunting-graph.md) in advanced hunting is now generally available. It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.
4040
- (GA) Advanced hunting now supports custom functions that use tabular parameters. With tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. [Learn more](advanced-hunting-custom-functions.md#create-custom-functions-with-tabular-parameters)
4141

0 commit comments

Comments
 (0)