Skip to content

Commit 12e2682

Browse files
schmurkyschmurky
committed
Updates
1 parent dc41970 commit 12e2682

File tree

34 files changed

+164
-0
lines changed

34 files changed

+164
-0
lines changed

‎defender-xdr/advanced-hunting-alertevidence-table copy.md‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
title: AlertEvidence table in the advanced hunting schema
3+
description: Learn about information associated with alerts in the AlertEvidence table of the advanced hunting schema
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
- Microsoft Sentinel in the Microsoft Defender portal
23+
ms.topic: reference
24+
ms.date: 03/28/2025
25+
---
26+
27+
# AlertEvidence
28+
29+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
30+
31+
32+
33+
The `AlertEvidence` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about various entities—files, IP addresses, URLs, users, or devices—associated with alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Use this reference to construct queries that return information from this table.
34+
35+
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
36+
37+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
38+
39+
| Column name | Data type | Description |
40+
|-------------|-----------|-------------|
41+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
42+
| `AlertId` | `string` | Unique identifier for the alert |
43+
| `Title` | `string` | Title of the alert |
44+
| `Categories` | `string` | List of categories that the information belongs to, in JSON array format |
45+
| `AttackTechniques` | `string` | MITRE ATT&CK techniques associated with the activity that triggered the alert |
46+
| `ServiceSource` | `string` | Product or service that provided the alert information |
47+
| `DetectionSource` | `string` | Detection technology or sensor that identified the notable component or activity |
48+
| `EntityType` | `string` | Type of object, such as a file, a process, a device, or a user |
49+
| `EvidenceRole` | `string` | How the entity is involved in an alert, indicating whether it is impacted or is merely related |
50+
| `EvidenceDirection` | `string` | Indicates whether the entity is the source or the destination of a network connection |
51+
| `FileName` | `string` | Name of the file that the recorded action was applied to |
52+
| `FolderPath` | `string` | Folder containing the file that the recorded action was applied to |
53+
| `SHA1` | `string` | SHA-1 of the file that the recorded action was applied to |
54+
| `SHA256` | `string` | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. |
55+
| `FileSize` | `long` | Size of the file in bytes |
56+
| `ThreatFamily` | `string` | Malware family that the suspicious or malicious file or process has been classified under |
57+
| `RemoteIP` | `string` | IP address that was being connected to |
58+
| `RemoteUrl` | `string` | URL or fully qualified domain name (FQDN) that was being connected to |
59+
| `AccountName` | `string` | User name of the account |
60+
| `AccountDomain` | `string` | Domain of the account |
61+
| `AccountSid` | `string` | Security Identifier (SID) of the account |
62+
| `AccountObjectId` | `string` | Unique identifier for the account in Microsoft Entra ID |
63+
| `AccountUpn` | `string` | User principal name (UPN) of the account |
64+
| `DeviceId` | `string` | Unique identifier for the device in the service |
65+
| `DeviceName` | `string` | Fully qualified domain name (FQDN) of the device |
66+
| `LocalIP` | `string` | IP address assigned to the local device used during communication |
67+
| `NetworkMessageId` | `string` | Unique identifier for the email, generated by Office 365 |
68+
| `EmailSubject` | `string` | Subject of the email |
69+
| `Application` | `string` | Application that performed the recorded action |
70+
| `ApplicationId` | `int` | Unique identifier for the application |
71+
| `OAuthApplicationId` | `string` | Unique identifier of the third-party OAuth application |
72+
| `ProcessCommandLine` | `string` | Command line used to create the new process |
73+
| `RegistryKey` |`string` | Registry key that the recorded action was applied to |
74+
| `RegistryValueName` |`string` | Name of the registry value that the recorded action was applied to |
75+
| `RegistryValueData` |`string` | Data of the registry value that the recorded action was applied to |
76+
| `AdditionalFields` | `string` | Additional information about the entity or event |
77+
| `Severity` | `string` | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert |
78+
| `CloudResource` | `string` | Cloud resource name |
79+
| `CloudPlatform` | `string` | The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform |
80+
| `ResourceType` | `string` | Type of cloud resource |
81+
| `ResourceID` | `string` | Unique identifier of the cloud resource accessed |
82+
| `SubscriptionId` | `string` | Unique identifier of the cloud service subscription |
83+
84+
## Related topics
85+
- [Advanced hunting overview](advanced-hunting-overview.md)
86+
- [Learn the query language](advanced-hunting-query-language.md)
87+
- [Use shared queries](advanced-hunting-shared-queries.md)
88+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
89+
- [Understand the schema](advanced-hunting-schema-tables.md)
90+
- [Apply query best practices](advanced-hunting-best-practices.md)
91+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-alertevidence-table.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@ ms.date: 03/28/2025
3232

3333
The `AlertEvidence` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about various entities—files, IP addresses, URLs, users, or devices—associated with alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Use this reference to construct queries that return information from this table.
3434

35+
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
36+
3537
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
3638

3739
| Column name | Data type | Description |

‎defender-xdr/advanced-hunting-cloudappevents-table.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ ms.date: 03/28/2025
3232

3333
The `CloudAppEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about events involving accounts and objects in Office 365 and other [cloud apps and services](#apps-and-services-covered). Use this reference to construct queries that return information from this table.
3434

35+
This advanced hunting table is populated by records from Microsoft Defender for Cloud Apps. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Cloud Apps in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
3536

3637
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
3738

‎defender-xdr/advanced-hunting-cloudauditevents-table.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ The `CloudAuditEvents` table in the [advanced hunting](advanced-hunting-overview
3636
> [!IMPORTANT]
3737
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
3838
39+
This advanced hunting table is populated by records from Microsoft Defender for Cloud. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Cloud in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
40+
3941
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
4042

4143
| Column name | Data type | Description |

‎defender-xdr/advanced-hunting-cloudprocessevents-table.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ The `CloudProcessEvents` table in the [advanced hunting](advanced-hunting-overvi
3535
> [!IMPORTANT]
3636
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
3737
38+
39+
This advanced hunting table is populated by records from Microsoft Defender for Cloud. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Cloud in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
40+
3841
For information on other tables in the advanced hunting schema, see the [advanced hunting reference](advanced-hunting-schema-tables.md).
3942

4043
| Column name | Data type | Description |

‎defender-xdr/advanced-hunting-devicebaselinecomplianceassessment-table.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,8 @@ ms.date: 03/28/2025
3838
3939
The `DeviceBaselineComplianceAssessment` table in the advanced hunting schema contains baseline compliance assessment snapshot, which indicates the status of various security configurations related to baseline profiles on devices.
4040

41+
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
42+
4143
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
4244

4345
| Column name | Data type | Description |

‎defender-xdr/advanced-hunting-devicebaselinecomplianceassessmentkb-table.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ ms.date: 03/28/2025
3636
3737
The `DeviceBaselineComplianceAssessmentKB` table in the advanced hunting schema contains information about various security configurations used by baseline compliance to assess devices.
3838

39+
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
40+
3941
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
4042

4143
| Column name | Data type | Description |

‎defender-xdr/advanced-hunting-devicebaselinecomplianceprofiles-table.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@ ms.date: 03/28/2025
3434
3535
The `DeviceBaselineComplianceProfiles` table in the advanced hunting schema contains baseline profiles used for monitoring device baseline compliance. Use this reference to construct queries that return information from the table.
3636

37+
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
38+
39+
3740
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
3841

3942
| Column name | Data type | Description |

‎defender-xdr/advanced-hunting-deviceevents-table.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,8 @@ The miscellaneous device events or `DeviceEvents` table in the [advanced hunting
3535
> [!TIP]
3636
> For detailed information about the events types (`ActionType` values) supported by a table, use the built-in schema reference available in Microsoft Defender XDR.
3737
38+
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
39+
3840
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
3941

4042

‎defender-xdr/advanced-hunting-devicefilecertificateinfo-table.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ ms.date: 03/28/2025
3131

3232
The `DeviceFileCertificateInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file signing certificates. This table uses data obtained from certificate verification activities regularly performed on files on endpoints.
3333

34+
This advanced hunting table is populated by records from Microsoft Defender for Endpoint. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
35+
3436
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
3537

3638
| Column name | Data type | Description |

0 commit comments

Comments
 (0)