Skip to content

Commit 524bbc6

Browse files
aditisrivastava07aditisrivastava07
authored
Merge pull request #4723 from MicrosoftDocs/main
[AutoPublish] main to live - 08/11 22:32 PDT | 08/12 11:02 IST
2 parents a94173b + 39d06f0 commit 524bbc6

File tree

5 files changed

+88
-5
lines changed

5 files changed

+88
-5
lines changed

‎ATPDocs/whats-new.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,12 @@ For updates about versions and features released six months ago or earlier, see
2525

2626
## August 2025
2727

28-
### Sensor version 2.246
28+
### Microsoft Defender for Identity sensor version updates
2929

30-
This version includes bug fixes and stability improvements for the Microsoft Defender for Identity sensor.
30+
|Version number |Updates |
31+
|---------|---------|
32+
|2.247|Includes bug fixes and stability improvements for the Microsoft Defender for Identity sensor.|
33+
|2.246|Includes bug fixes and stability improvements for the Microsoft Defender for Identity sensor. |
3134

3235
### Detection update: Suspected Brute Force attack (Kerberos, NTLM)
3336

‎defender-xdr/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,8 @@
313313
href: advanced-hunting-graphapiauditevents-table.md
314314
- name: IdentityDirectoryEvents
315315
href: advanced-hunting-identitydirectoryevents-table.md
316+
- name: IdentityEvents
317+
href: advanced-hunting-identityevents-table.md
316318
- name: IdentityInfo
317319
href: advanced-hunting-identityinfo-table.md
318320
- name: IdentityLogonEvents

‎defender-xdr/advanced-hunting-identityevents-table.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
---
2+
title: IdentityEvents table in the advanced hunting schema
3+
description: Learn about the IdentityEvents table in the advanced hunting schema, which contains information about identity events obtained from other cloud identity service providers.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: pauloliveria
10+
author: poliveria
11+
ms.localizationpriority: medium
12+
manager: orspodek
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
- Microsoft Sentinel in the Microsoft Defender portal
23+
ms.topic: reference
24+
ms.date: 08/07/2025
25+
---
26+
27+
# IdentityEvents (Preview)
28+
29+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
30+
31+
The `IdentityEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about identity events obtained from other cloud identity service providers. Use this reference to construct queries that return information from this table.
32+
33+
> [!IMPORTANT]
34+
> Some information relates to prereleased product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35+
36+
This advanced hunting table is populated by records from Microsoft Defender for Identity. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Identity in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
37+
38+
>[!NOTE]
39+
>This advanced hunting table is populated only when other identity services like Okta are connected to Defender for Identity.
40+
41+
42+
For information on other tables in the advanced hunting schema, see the [advanced hunting reference](advanced-hunting-schema-tables.md).
43+
44+
| Column name | Data type | Description |
45+
|-------------|-----------|-------------|
46+
| `Timestamp ` | `datetime` | Date and time when the record was generated |
47+
| `ReportId ` | `string` | Unique identifier for the event |
48+
| `AccountId ` | `string` | Unique identifier for the account in the source application |
49+
| `AccountType` | `string` | Type of user account, indicating its general role like User, SystemPrincipal |
50+
| `AccountDisplayName` | `string` | Name displayed in the address book entry for the account user. This is usually a combination of the given name, middle initial, and surname of the user. |
51+
| `AccountUpn` | `string` | Alternate ID, email, or name for the account in the source application |
52+
| `ActionType` | `string` | Type of activity that triggered the event in the raw format received from the source application |
53+
| `ActionResult` | `string` | Result of the action |
54+
| `ActionFailureReason` | `string` | Information explaining why the recorded action failed |
55+
| `IPAddress` | `string` | IP address assigned to the device and used during related network communications |
56+
| `UserAgent` | `string` | User agent information from the web browser or other client application |
57+
| `TargetObjects` | `dynamic` | List of the target objects of this activity. Target object can be user, group, role, domain, application, and more. |
58+
| `Application` | `string` | The source application where this event was received from |
59+
| `ApplicationInstanceId` | `string` | Domain of the source application |
60+
| `ApplicationEventId` | `string` | Raw event ID provided by the source application |
61+
| `ApplicationSessionId` | `string` | Raw session ID provided by the source application |
62+
| `RawEventData` | `dynamic` | Full raw event information from the source application in JSON format |
63+
| `AdditionalFields` | `dynamic` | Additional information about the entity or event |
64+
65+
66+
## Related topics
67+
68+
- [Advanced hunting overview](advanced-hunting-overview.md)
69+
- [Learn the query language](advanced-hunting-query-language.md)
70+
- [Use shared queries](advanced-hunting-shared-queries.md)
71+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
72+
- [Understand the schema](advanced-hunting-schema-tables.md)
73+
- [Apply query best practices](advanced-hunting-best-practices.md)
74+
75+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-schema-tables.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,7 @@ The following reference lists all the tables in the schema. Each table name link
100100
| **[ExposureGraphNodes](advanced-hunting-exposuregraphnodes-table.md)** | Microsoft Security Exposure Management exposure graph node information, about organizational entities and their properties |
101101
| **[GraphApiAuditEvents](advanced-hunting-graphapiauditevents-table.md)** (Preview) | Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant |
102102
| **[IdentityDirectoryEvents](advanced-hunting-identitydirectoryevents-table.md)** | Events involving an on-premises domain controller running Active Directory (AD). This table covers a range of identity-related events and system events on the domain controller. |
103+
| **[IdentityEvents](advanced-hunting-identityevents-table.md)** (Preview) | Information about identity events obtained from other cloud identity service providers |
103104
| **[IdentityInfo](advanced-hunting-identityinfo-table.md)** | Account information from various sources, including Microsoft Entra ID |
104105
| **[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)** | Authentication events on Active Directory and Microsoft online services |
105106
| **[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)** | Queries for Active Directory objects, such as users, groups, devices, and domains |

‎defender-xdr/whats-new.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,16 +33,18 @@ For more information on what's new with other Microsoft Defender security produc
3333
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
3434

3535
## August 2025
36+
- (Preview) The following advanced hunting schema tables are now available for preview:
37+
- The [`CloudStorageAggregatedEvents`](advanced-hunting-cloudstorageaggregatedevents-table.md) table contains information about storage activity and related events
38+
- The [`IdentityEvents`](advanced-hunting-identityevents-table.md) table contains information about identity events obtained from other cloud identity service providers
39+
- (Preview) Advanced hunting now lets you investigate Microsoft Defender for Cloud behaviors. For more information, see [Investigate behaviors with advanced hunting](/defender-cloud-apps/behaviors).
40+
- (Preview) In advanced hunting, the number of [query results](advanced-hunting-query-results.md) displayed in the Microsoft Defender portal has been increased to 100,000.
3641
- (GA) [Microsoft Defender Experts for XDR](dex-xdr-overview.md) and [Microsoft Defender Experts for Hunting](defender-experts-for-hunting.md) customers can now expand their service coverage to include server and cloud workloads protected by Microsoft Defender for Cloud through the respective add-ons, **Microsoft Defender Experts for Servers** and **Microsoft Defender Experts for Hunting - Servers**. [Learn more](faq-cloud-coverage-defender-experts.md)
3742
- (GA) Defender Experts for XDR customers can now [incorporate third-party network signals](third-party-enrichment-defender-experts.md) for enrichment, which could allow our security analysts to not only gain a more comprehensive view of an attack's path that allows for faster and more thorough detection and response, but also provide customers with a more holistic view of the threat in their environments.
3843
- (GA) In advanced hunting, you can now [view all your user-defined rules](custom-detection-manage.md)—both custom detection rules and analytics rules—in the **Detection rules** page. This feature also brings the following improvements:
3944
- You can now filter for *every* column (in addition to **Frequency** and **Organizational scope**).
4045
- For multiworkspace organizations that have onboarded multiple workspaces to Microsoft Defender, you can now view the **Workspace ID** column and filter by workspace.
4146
- You can now view the details pane even for analytics rules.
4247
- You can now perform the following actions on analytics rules: Turn on/off, Delete, Edit.
43-
- (Preview) In advanced hunting, the number of [query results](advanced-hunting-query-results.md) displayed in the Microsoft Defender portal has been increased to 100,000.
44-
- (Preview) The [`CloudStorageAggregatedEvents`](advanced-hunting-cloudstorageaggregatedevents-table.md) table in advanced hunting is now available for preview. This table contains information about storage activity and related events.
45-
- (Preview) Advanced hunting now lets you investigate Microsoft Defender for Cloud behaviors. For more information, see [Investigate behaviors with advanced hunting](/defender-cloud-apps/behaviors).
4648

4749
## July 2025
4850
- (Preview) The [`GraphApiAuditEvents`](advanced-hunting-graphapiauditevents-table.md) table in advanced hunting is now available for preview. This table contains information about Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant.

0 commit comments

Comments
 (0)