Skip to content

Commit 807654d

Browse files
m365-skilling-repo-management[bot]m365-skilling-repo-management[bot]
authored
Merge pull request #4405 from MicrosoftDocs/main
[AutoPublish] main to live - 07/02 10:31 PDT | 07/02 23:01 IST
2 parents 894fda0 + 71a8135 commit 807654d

File tree

5 files changed

+103
-1
lines changed

5 files changed

+103
-1
lines changed

‎defender-xdr/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,6 +293,8 @@
293293
href: advanced-hunting-devicetvmsoftwarevulnerabilities-table.md
294294
- name: DeviceTvmSoftwareVulnerabilitiesKB
295295
href: advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md
296+
- name: DisruptionAndResponseEvents
297+
href: advanced-hunting-disruptionandresponseevents-table.md
296298
- name: EmailAttachmentInfo
297299
href: advanced-hunting-emailattachmentinfo-table.md
298300
- name: EmailEvents

‎defender-xdr/advanced-hunting-disruptionandresponseevents-table.md‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
---
2+
title: DisruptionAndResponseEvents table in the advanced hunting schema
3+
description: Learn about the DisruptionAndResponseEvents table in the advanced hunting schema
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 06/11/2025
22+
---
23+
24+
# DisruptionAndResponseEvents (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
34+
The `DisruptionAndResponseEvents` table in the [advanced hunting](advanced-hunting-overview.md) contains information about [automatic attack disruption](automatic-attack-disruption.md) events in Microsoft Defender XDR. These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads.
35+
36+
Users can use this table to increase their visibility and awareness of active, complex attacks disrupted by automatic attack disruption. Understanding the scope of even complex attacks, their context, impact, and why disruption actions were taken, can help users make better and faster decisions and allocate resources more efficiently.
37+
38+
This advanced hunting table is populated by records from various Microsoft security services. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return complete results. For more information about how to deploy supported services in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
39+
40+
Use this reference to construct queries that return information from this table.
41+
42+
> [!TIP]
43+
> For detailed information about the events types (`ActionType` values) supported by a table, use the built-in schema reference available in Microsoft Defender XDR.
44+
45+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
46+
47+
48+
| Column name | Data type | Description |
49+
|-------------|-----------|-------------|
50+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
51+
| `ActionType` | `string` | Type of disruption action taken, for example: ContainedUserLogonBlocked, ContainedUserSmbFileOpenBlocked, SafeBootGuardApplied |
52+
| `DeviceId` | `string` | Unique identifier for the device that reported the event; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack |
53+
| `SourceDeviceId` | `string` | Unique identifier for the device that the attack originated from |
54+
| `TargetDeviceId` | `string` | Unique identifier for the device that was targeted or attacked |
55+
| `TargetDeviceName ` | `string` | Name of the device that was targeted or attacked |
56+
| `TargetDomainName ` | `string` | Domain name of the device that was targeted or attacked |
57+
| `DeviceName` | `string` | Name of the device that reported the event; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack |
58+
| `DomainName` | `string` | Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack |
59+
| `InitiatingProcessId` | `integer` | Process ID (PID) of the process that triggered that block action, based on the perspective of the reporting device |
60+
| `InitiatingProcessFileName` | `string` |Name of the process that triggered the block action, based on the perspective of the reporting device |
61+
| `SourceUserSid` | `string` | The security identifier of the account conducting the malicious activity |
62+
| `SourceUserName` | `string` | The user name of the account conducting the malicious activity |
63+
| `SourceUserDomainName` | `string` | The domain name of the account conducting the malicious activity |
64+
| `SourceIPAddress` | `string` | IP address where the attacker communication originated from and was blocked by automatic attack disruption |
65+
| `SourcePort` | `integer` | Port where the attacker communication originated from |
66+
| `IPAddress` | `string` | IP address that the attacker attempted to access |
67+
| `Port` | `string` | Port that the attacker attempted to access |
68+
| `SourceDeviceName` | `string` | Host name of the device where the attack originated from |
69+
| `SourceDomainName` | `string` | Domain name of the device where the attack originated from |
70+
| `AuthenticationProtocol` | `string` | Authentication protocol that the compromised user used to sign in; possible values: Undefined, NTLM, Kerberos |
71+
| `Service` | `string` | Name of the service the attacker attempted to use, if the attacker signed in using Kerberos or NTLM; for example: SMB, HTTP, cifs, SMB, host, ldap, SMB, krbtgt |
72+
| `InterfaceUuidSourceDomainName` | `string` | Unique identifier (UUID) for the Remote Procedure Call (RPC) interface that the attacker attempted to access |
73+
| `InterfaceFriendlyName` | `string` |Friendly name of the interface represented by the interface UUID |
74+
| `FileName` | `string` | Name of the file that the attacker attempted to access |
75+
| `ShareName` | `string` | Name of the share location that the attacker attempted to access |
76+
| `LogonType` | `string` | Type of logon session the user attempted; possible values: interactive, remote interactive (RDP), network, batch job, service |
77+
| `LogonId ` | `long` | Identifier for a logon session; this is unique on the same device only between restarts |
78+
| `SessionId ` | `long` | Unique number assigned to a user by a website's server for the duration of the visit or session |
79+
| `CompromisedAccountCount` | `integer` | Number of compromised accounts that are part of the policy |
80+
| `PolicyId` | `string` | Unique identifier for the policy |
81+
| `PolicyName` | `string` | Name of the policy |
82+
| `PolicyVersion` | `string` | Version of the policy |
83+
| `PolicyHash` | `string` | Unique hash of the policy |
84+
| `DataSources` | `array` |Products or services that provided information for the event; for example: Microsoft Defender for Endpoint |
85+
| `IsPolicyOn` | `boolean` |Indicates the current state of the policy on the device at the time of the disruption event; possible values: true (the policy is on, therefore it was applied or enforced), false (the policy was turned off or revoked from the device) |
86+
|`ReportType` | `string` | The nature and impact level of the reported event; possible values: Prevented (the action, such as a connection or authentication attempt, was fully blocked before execution), Blocked (an active connection or session was forcibly terminated, with partial impact on the device), PolicyUpdated (the client received and possibly applied a new policy) |
87+
88+
## Related topics
89+
- [Advanced hunting overview](advanced-hunting-overview.md)
90+
- [Learn the query language](advanced-hunting-query-language.md)
91+
- [Use shared queries](advanced-hunting-shared-queries.md)
92+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
93+
- [Understand the schema](advanced-hunting-schema-tables.md)
94+
- [Apply query best practices](advanced-hunting-best-practices.md)

‎defender-xdr/advanced-hunting-schema-tables.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ The following reference lists all the tables in the schema. Each table name link
9090
| **[DeviceTvmSoftwareInventory](advanced-hunting-devicetvmsoftwareinventory-table.md)** | Inventory of software installed on devices, including their version information and end-of-support status |
9191
| **[DeviceTvmSoftwareVulnerabilities](advanced-hunting-devicetvmsoftwarevulnerabilities-table.md)** | Software vulnerabilities found on devices and the list of available security updates that address each vulnerability |
9292
| **[DeviceTvmSoftwareVulnerabilitiesKB](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available |
93+
| **[DisruptionAndResponseEvents](advanced-hunting-disruptionandresponseevents-table.md)** (Preview)| [Automatic attack disruption](automatic-attack-disruption.md) events in Microsoft Defender XDR|
9394
| **[EmailAttachmentInfo](advanced-hunting-emailattachmentinfo-table.md)** | Information about files attached to emails |
9495
| **[EmailEvents](advanced-hunting-emailevents-table.md)** | Microsoft 365 email events, including email delivery and blocking events |
9596
| **[EmailPostDeliveryEvents](advanced-hunting-emailpostdeliveryevents-table.md)** | Security events that occur post-delivery, after Microsoft 365 delivers the emails to the recipient mailbox |

‎defender-xdr/custom-detection-rules.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,8 @@ When you save a new rule, it runs and checks for matches from the past 30 days o
149149
> [!TIP]
150150
> Match the time filters in your query with the lookback period. Results outside of the lookback period are ignored.
151151
152-
When you edit a rule, it will run with the applied changes in the next run time scheduled according to the frequency you set. The rule frequency is based on the event timestamp and not the ingestion time.
152+
When you edit a rule, the changes are applied in the next run time scheduled according to the frequency you set. The rule frequency is based on the event timestamp and not the ingestion time. There might also be small delays in specific runs, whereby the configured frequency is not 100% accurate.
153+
153154

154155
##### Continuous (NRT) frequency
155156

‎defender-xdr/whats-new.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,13 @@ For more information on what's new with other Microsoft Defender security produc
3232

3333
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
3434

35+
## July 2025
36+
- (Preview) The [`DisruptionAndResponseEvents`](advanced-hunting-disruptionandresponseevents-table.md) table, now available in advanced hunting, contains information about [automatic attack disruption](automatic-attack-disruption.md) events in Microsoft Defender XDR. These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads. Increase your visibility and awareness of active, complex attacks disrupted by attack disruption to understand the attacks' scope, context, impact, and actions taken.
37+
3538
## June 2025
3639
- (GA) In [advanced hunting](advanced-hunting-defender-use-custom-rules.md#use-adx-operator-for-azure-data-explorer-queries), Microsoft Defender portal users can now use the `adx()` operator to query tables stored in Azure Data Explorer. You no longer need to go to log analytics in Microsoft Sentinel to use this operator if you're already in Microsoft Defender.
3740

41+
3842
## May 2025
3943
- (Preview) In advanced hunting, you can now [view all your user-defined rules](custom-detection-manage.md)—both custom detection rules and analytics rules—in the **Detection rules** page. This feature also brings the following improvements:
4044
- You can now filter for *every* column (in addition to **Frequency** and **Organizational scope**).

0 commit comments

Comments
 (0)