Skip to content

Commit 57327e1

Browse files
denisebmsftdenisebmsft
committed
Merge branch 'main' into pr/1769
2 parents f13a09a + b7cf34d commit 57327e1

File tree

6 files changed

+9
-11
lines changed

6 files changed

+9
-11
lines changed

‎CloudAppSecurityDocs/behaviors.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,8 @@ The behaviors schema in the **Advanced hunting** page is similar to the [alerts
7373

7474
|Table name |Description |
7575
|---------|---------|
76-
|[BehaviorInfo ](/microsoft-365/security/defender/advanced-hunting-behaviorinfo-table) | Record per behavior with its metadata, including behavior title, MITRE Attack categories, and techniques. |
77-
|[BehaviorEntities ](/microsoft-365/security/defender/advanced-hunting-behaviorentities-table) | Information on the entities that were part of the behavior. Can be multiple records per behavior. |
76+
|[BehaviorInfo ](/microsoft-365/security/defender/advanced-hunting-behaviorinfo-table) | Record per behavior with its metadata, including behavior title, MITRE Attack categories, and techniques. (Not available for GCC.) |
77+
|[BehaviorEntities ](/microsoft-365/security/defender/advanced-hunting-behaviorentities-table) | Information on the entities that were part of the behavior. Can be multiple records per behavior. (Not available for GCC.) |
7878

7979
To get complete information on a behavior and its entities, use `BehaviorId` as the primary key for the join. For example:
8080

‎defender-xdr/advanced-hunting-behaviorentities-table.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,9 @@ ms.date: 12/29/2023
3030

3131
The `BehaviorEntities` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about behaviors in Microsoft Defender for Cloud Apps. Use this reference to construct queries that return information from this table.
3232

33-
> [!IMPORTANT]
34-
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
3533

3634
> [!IMPORTANT]
37-
> Behaviors feature is now in preview. Have feedback to share? Fill out our [feedback form](https://forms.office.com/r/x0mX5hBkGu).
35+
> The `BehaviorEntities` table is in preview and is not available for GCC. The information here may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Have feedback to share? Fill out our [feedback form](https://forms.office.com/r/x0mX5hBkGu).
3836
3937
Behaviors are a type of data in Microsoft Defender XDR based on one or more raw events. Behaviors provide contextual insight into events and can, but not necessarily, indicate malicious activity. [Read more about behaviors](/defender-cloud-apps/behaviors)
4038

‎defender-xdr/advanced-hunting-behaviorinfo-table.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,7 @@ ms.date: 12/29/2023
3535
The `BehaviorInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts from Microsoft Defender for Cloud Apps. Use this reference to construct queries that return information from this table.
3636

3737
> [!IMPORTANT]
38-
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
39-
40-
> [!IMPORTANT]
41-
> Behaviors feature is now in preview. Have feedback to share? Fill out our [feedback form](https://forms.office.com/r/x0mX5hBkGu).
38+
> The `BehaviorInfo` table is in preview and is not available for GCC. The information here may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. Have feedback to share? Fill out our [feedback form](https://forms.office.com/r/x0mX5hBkGu).
4239
4340
Behaviors are a type of data in Microsoft Defender XDR based on one or more raw events. Behaviors provide contextual insight into events and can, but not necessarily, indicate malicious activity. [Read more about behaviors](/defender-cloud-apps/behaviors)
4441

‎defender-xdr/advanced-hunting-errors.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ ms.collection:
1616
- tier3
1717
ms.custom:
1818
- cx-ti
19+
- cx-ah
1920
ms.topic: error-reference
2021
ms.date: 10/29/2024
2122
---

‎defender-xdr/advanced-hunting-limits.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ ms.collection:
1616
- tier3
1717
ms.custom:
1818
- cx-ti
19+
- cx-ah
1920
ms.topic: how-to
2021
ms.date: 10/29/2024
2122
---

‎defender-xdr/advanced-hunting-schema-tables.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,10 @@ The following reference lists all the tables in the schema. Each table name link
5858
| **[AADSpnSignInEventsBeta](advanced-hunting-aadspnsignineventsbeta-table.md)** | Microsoft Entra service principal and managed identity sign-ins |
5959
| **[AlertEvidence](advanced-hunting-alertevidence-table.md)** | Files, IP addresses, URLs, users, or devices associated with alerts |
6060
| **[AlertInfo](advanced-hunting-alertinfo-table.md)** | Alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity, including severity information and threat categorization |
61-
| **[BehaviorEntities](advanced-hunting-behaviorentities-table.md)** (Preview) | Behavior data types in Microsoft Defender for Cloud Apps |
62-
| **[BehaviorInfo](advanced-hunting-behaviorinfo-table.md)** (Preview) | Alerts from Microsoft Defender for Cloud Apps |
61+
| **[BehaviorEntities](advanced-hunting-behaviorentities-table.md)** (Preview) | Behavior data types in Microsoft Defender for Cloud Apps (not available for GCC) |
62+
| **[BehaviorInfo](advanced-hunting-behaviorinfo-table.md)** (Preview) | Alerts from Microsoft Defender for Cloud Apps (not available for GCC) |
6363
| **[CloudAppEvents](advanced-hunting-cloudappevents-table.md)** | Events involving accounts and objects in Office 365 and other cloud apps and services |
64+
| **[CloudAuditEvents](advanced-hunting-cloudauditevents-table.md)** | Cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
6465
| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection |
6566
| **[DeviceFileCertificateInfo](advanced-hunting-DeviceFileCertificateInfo-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints |
6667
| **[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)** | File creation, modification, and other file system events |

0 commit comments

Comments
 (0)