Skip to content

Commit 7636d4e

Browse files
m365-skilling-repo-management[bot]m365-skilling-repo-management[bot]
authored
Merge pull request #4874 from MicrosoftDocs/main
[AutoPublish] main to live - 08/31 01:31 PDT | 08/31 14:01 IST
2 parents 8e3dfbd + 8df4207 commit 7636d4e

File tree

2 files changed

+35
-33
lines changed

2 files changed

+35
-33
lines changed

‎defender-xdr/advanced-hunting-schema-changes.md‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -38,41 +38,16 @@ Naming changes are automatically applied to queries that are saved in Microsoft
3838
- Queries that are saved elsewhere outside Microsoft Defender XDR
3939

4040

41-
4241
## May 2025
4342
In the [`IdentityInfo`](advanced-hunting-identityinfo-table.md) table, the `SourceProvider` column was replaced by the `IdentityEnvironment` column. This change was made to streamline the unified `IdentityInfo` table with a similar table in Microsoft Sentinel log analytics. Note that a new column, `SourceProviders` (with an *s*) was added in the unified table. This column refers to the source providers of the accounts for the identity.
4443

44+
## May 2021
4545

46-
## December 2020
47-
48-
| Table name | Original column name | New column name | Reason for change
49-
|--|--|--|--|
50-
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailAction` | `EmailAction` | Customer feedback |
51-
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicy` | `EmailActionPolicy` | Customer feedback |
52-
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicyGuid` | `EmailActionPolicyGuid` | Customer feedback |
53-
54-
## January 2021
46+
The `AppFileEvents` table has been deprecated. The `CloudAppEvents` table includes information that used to be in the `AppFileEvents` table, along with other activities in cloud services.
5547

56-
| Column name | Original value name | New value name | Reason for change
57-
|--|--|--|--|
58-
| `DetectionSource` | Defender for Cloud Apps | Microsoft Defender for Cloud Apps | Rebranding |
59-
| `DetectionSource` | WindowsDefenderAtp| EDR| Rebranding |
60-
| `DetectionSource` | WindowsDefenderAv | Antivirus | Rebranding |
61-
| `DetectionSource` | WindowsDefenderSmartScreen | SmartScreen | Rebranding |
62-
| `DetectionSource` | CustomerTI | Custom TI | Rebranding |
63-
| `DetectionSource` | OfficeATP | Microsoft Defender for Office 365 | Rebranding |
64-
| `DetectionSource` | MTP | Microsoft Defender XDR | Rebranding |
65-
| `DetectionSource` | AzureATP | Microsoft Defender for Identity | Rebranding |
66-
| `DetectionSource` | CustomDetection | Custom detection | Rebranding |
67-
| `DetectionSource` | AutomatedInvestigation |Automated investigation | Rebranding |
68-
| `DetectionSource` | ThreatExperts | Microsoft Threat Experts | Rebranding |
69-
| `DetectionSource` | 3rd party TI | 3rd Party sensors | Rebranding |
70-
| `ServiceSource` | Microsoft Defender ATP| Microsoft Defender for Endpoint | Rebranding |
71-
|`ServiceSource` |Microsoft Threat Protection | Microsoft Defender XDR | Rebranding |
72-
| `ServiceSource` | Office 365 ATP |Microsoft Defender for Office 365 | Rebranding |
73-
| `ServiceSource` |Azure ATP |Microsoft Defender for Identity | Rebranding |
48+
## March 2021
7449

75-
`DetectionSource` is available in the [AlertInfo](advanced-hunting-alertinfo-table.md) table. `ServiceSource` is available in the [AlertEvidence](advanced-hunting-alertevidence-table.md) and [AlertInfo](advanced-hunting-alertinfo-table.md) tables.
50+
The `DeviceTvmSoftwareInventoryVulnerabilities` table has been deprecated. Replacing it are the `DeviceTvmSoftwareInventory` and `DeviceTvmSoftwareVulnerabilities` tables.
7651

7752
## February 2021
7853

@@ -98,13 +73,38 @@ In the [`IdentityInfo`](advanced-hunting-identityinfo-table.md) table, the `Sour
9873
| `DeviceEvents` | `UsbDriveUnmount` | `UsbDriveUnmounted` | Customer feedback |
9974
| `DeviceEvents` | `WriteProcessMemoryApiCall` | `WriteToLsassProcessMemory` | Customer feedback |
10075

101-
## March 2021
76+
## January 2021
10277

103-
The `DeviceTvmSoftwareInventoryVulnerabilities` table has been deprecated. Replacing it are the `DeviceTvmSoftwareInventory` and `DeviceTvmSoftwareVulnerabilities` tables.
78+
| Column name | Original value name | New value name | Reason for change
79+
|--|--|--|--|
80+
| `DetectionSource` | Defender for Cloud Apps | Microsoft Defender for Cloud Apps | Rebranding |
81+
| `DetectionSource` | WindowsDefenderAtp| EDR| Rebranding |
82+
| `DetectionSource` | WindowsDefenderAv | Antivirus | Rebranding |
83+
| `DetectionSource` | WindowsDefenderSmartScreen | SmartScreen | Rebranding |
84+
| `DetectionSource` | CustomerTI | Custom TI | Rebranding |
85+
| `DetectionSource` | OfficeATP | Microsoft Defender for Office 365 | Rebranding |
86+
| `DetectionSource` | MTP | Microsoft Defender XDR | Rebranding |
87+
| `DetectionSource` | AzureATP | Microsoft Defender for Identity | Rebranding |
88+
| `DetectionSource` | CustomDetection | Custom detection | Rebranding |
89+
| `DetectionSource` | AutomatedInvestigation |Automated investigation | Rebranding |
90+
| `DetectionSource` | ThreatExperts | Microsoft Threat Experts | Rebranding |
91+
| `DetectionSource` | 3rd party TI | 3rd Party sensors | Rebranding |
92+
| `ServiceSource` | Microsoft Defender ATP| Microsoft Defender for Endpoint | Rebranding |
93+
|`ServiceSource` |Microsoft Threat Protection | Microsoft Defender XDR | Rebranding |
94+
| `ServiceSource` | Office 365 ATP |Microsoft Defender for Office 365 | Rebranding |
95+
| `ServiceSource` |Azure ATP |Microsoft Defender for Identity | Rebranding |
10496

105-
## May 2021
97+
`DetectionSource` is available in the [AlertInfo](advanced-hunting-alertinfo-table.md) table. `ServiceSource` is available in the [AlertEvidence](advanced-hunting-alertevidence-table.md) and [AlertInfo](advanced-hunting-alertinfo-table.md) tables.
98+
99+
100+
## December 2020
101+
102+
| Table name | Original column name | New column name | Reason for change
103+
|--|--|--|--|
104+
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailAction` | `EmailAction` | Customer feedback |
105+
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicy` | `EmailActionPolicy` | Customer feedback |
106+
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicyGuid` | `EmailActionPolicyGuid` | Customer feedback |
106107

107-
The `AppFileEvents` table has been deprecated. The `CloudAppEvents` table includes information that used to be in the `AppFileEvents` table, along with other activities in cloud services.
108108

109109
## Related topics
110110
- [Advanced hunting overview](advanced-hunting-overview.md)

‎unified-secops-platform/microsoft-sentinel-onboard.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ To onboard and use Microsoft Sentinel in the Defender portal, you must have the
6969
|**Take investigative actions on incidents** |[Microsoft Sentinel Contributor](/azure/role-based-access-control/built-in-roles#microsoft-sentinel-contributor) or a role with the following actions:</br>- Microsoft.OperationalInsights/workspaces/read</br>- Microsoft.OperationalInsights/workspaces/query/read</br>- Microsoft.SecurityInsights/incidents/read</br>- Microsoft.SecurityInsights/incidents/write</br>- Microsoft.SecurityInsights/incidents/comments/read</br>- Microsoft.SecurityInsights/incidents/comments/write</br>- Microsoft.SecurityInsights/incidents/relations/read</br>- Microsoft.SecurityInsights/incidents/relations/write</br>- Microsoft.SecurityInsights/incidents/tasks/read</br>- Microsoft.SecurityInsights/incidents/tasks/write |Subscription, resource group, or workspace resource |
7070
|**Create a support request** |[Owner](/azure/role-based-access-control/built-in-roles#owner) or </br> [Contributor](/azure/role-based-access-control/built-in-roles#contributor) or </br> [Support request contributor](/azure/role-based-access-control/built-in-roles#support-request-contributor) or a custom role with Microsoft.Support/*|Subscription |
7171

72+
If you're working with multiple tenants, note that [granular delegated admin privileges (GDAP)](/partner-center/gdap-introduction) with [Azure Lighthouse](/azure/sentinel/multiple-tenants-service-providers) isn't supported for Microsoft Sentinel data in the Defender portal. Instead, use [Microsoft Entra B2B authentication](/entra/external-id/what-is-b2b). For more information, see [Set up Microsoft Defender multitenant management](mto-requirements.md#review-the-requirements).
73+
7274
After you connect Microsoft Sentinel to the Defender portal, your existing Azure role-based access control (RBAC) permissions allow you to work with the Microsoft Sentinel features that you have access to. Continue to manage roles and permissions for your Microsoft Sentinel users from the Azure portal, as any Azure RBAC changes are reflected in the Defender portal.
7375

7476
For more information, see [Roles and permissions in Microsoft Sentinel](/azure/sentinel/roles) and [Manage access to Microsoft Sentinel data by resource](/azure/sentinel/resource-context-rbac).

0 commit comments

Comments
 (0)