Skip to content

Commit 47ead9e

Browse files
authored
Fix typos in documentation.
1 parent f1890c9 commit 47ead9e

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

defender-xdr/advanced-hunting-cloudappevents-table.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ For information on other tables in the advanced hunting schema, [see the advance
4545
| `AccountDisplayName` | `string` | Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user. |
4646
| `IsAdminOperation` | `bool` | Indicates whether the activity was performed by an administrator |
4747
| `DeviceType` | `string` | Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer |
48-
| `OSPlatform` | `string` | Platform of the operating system running on the device. This column indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10 and Windows 7. |
48+
| `OSPlatform` | `string` | Platform of the operating system running on the device. This column indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10, and Windows 7. |
4949
| `IPAddress` | `string` | IP address assigned to the device during communication |
5050
| `IsAnonymousProxy` | `boolean` | Indicates whether the IP address belongs to a known anonymous proxy |
5151
| `CountryCode` | `string` | Two-letter code indicating the country where the client IP address is geolocated |
@@ -67,7 +67,7 @@ For information on other tables in the advanced hunting schema, [see the advance
6767
| `RawEventData` | `dynamic` | Raw event information from the source application or service in JSON format |
6868
| `AdditionalFields` | `dynamic` | Additional information about the entity or event |
6969
| `LastSeenForUser` | `dynamic`|Indicates the number of days since a specific attribute was last seen for the user. A value of 0 means the attribute was seen today, a negative value indicates the attribute is being seen for the first time, and a positive value represents the number of days since the attribute was last seen. For example: `{"ActionType":"0","OSPlatform":"4","ISP":"-1"}`|
70-
| `UncommonForUser` | `dynamic`|Lists the attributes in the event that are uncommon for the user, helping to rule out false positives and find anomalies. For example: `["ActivityType","ActionType"].` To filter out non-anomalous results: events with low or insignificant security value won't go through enrichment processes and will have a value of "", while high-value events will go through enrichment processes and, if no anomalies are found, will have a value of "[]".|
70+
| `UncommonForUser` | `dynamic`|Lists the attributes in the event that are uncommon for the user, helping to rule out false positives and find anomalies. For example: `["ActivityType","ActionType"].` To filter out nonanomalous results: events with low or insignificant security value won't go through enrichment processes and will have a value of "", while high-value events will go through enrichment processes and, if no anomalies are found, will have a value of "[]".|
7171
| `AuditSource` | `string` |Audit data source. Possible values are one of the following: <br>- Defender for Cloud Apps access control <br>- Defender for Cloud Apps session control <br> - Defender for Cloud Apps app connector |
7272
| `SessionData` |`dynamic` |The Defender for Cloud Apps session ID for access or session control. For example: `{InLineSessionId:"232342"}` |
7373
|`OAuthAppId`|`string`|A unique identifier that is assigned to an application when it's registered to Microsoft Entra with OAuth 2.0 protocol.|

0 commit comments

Comments
 (0)