Skip to content

Commit 8df4207

Browse files
mberdugomberdugo
authored
Merge pull request #4829 from sbreingold-ms/wi-476568-reorder-naming-schema-newest-first
wi-476568 reordered schema name changes chronologically
2 parents f42e364 + 16c7e09 commit 8df4207

File tree

1 file changed

+33
-33
lines changed

1 file changed

+33
-33
lines changed

‎defender-xdr/advanced-hunting-schema-changes.md‎

Lines changed: 33 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -38,41 +38,16 @@ Naming changes are automatically applied to queries that are saved in Microsoft
3838
- Queries that are saved elsewhere outside Microsoft Defender XDR
3939

4040

41-
4241
## May 2025
4342
In the [`IdentityInfo`](advanced-hunting-identityinfo-table.md) table, the `SourceProvider` column was replaced by the `IdentityEnvironment` column. This change was made to streamline the unified `IdentityInfo` table with a similar table in Microsoft Sentinel log analytics. Note that a new column, `SourceProviders` (with an *s*) was added in the unified table. This column refers to the source providers of the accounts for the identity.
4443

44+
## May 2021
4545

46-
## December 2020
47-
48-
| Table name | Original column name | New column name | Reason for change
49-
|--|--|--|--|
50-
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailAction` | `EmailAction` | Customer feedback |
51-
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicy` | `EmailActionPolicy` | Customer feedback |
52-
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicyGuid` | `EmailActionPolicyGuid` | Customer feedback |
53-
54-
## January 2021
46+
The `AppFileEvents` table has been deprecated. The `CloudAppEvents` table includes information that used to be in the `AppFileEvents` table, along with other activities in cloud services.
5547

56-
| Column name | Original value name | New value name | Reason for change
57-
|--|--|--|--|
58-
| `DetectionSource` | Defender for Cloud Apps | Microsoft Defender for Cloud Apps | Rebranding |
59-
| `DetectionSource` | WindowsDefenderAtp| EDR| Rebranding |
60-
| `DetectionSource` | WindowsDefenderAv | Antivirus | Rebranding |
61-
| `DetectionSource` | WindowsDefenderSmartScreen | SmartScreen | Rebranding |
62-
| `DetectionSource` | CustomerTI | Custom TI | Rebranding |
63-
| `DetectionSource` | OfficeATP | Microsoft Defender for Office 365 | Rebranding |
64-
| `DetectionSource` | MTP | Microsoft Defender XDR | Rebranding |
65-
| `DetectionSource` | AzureATP | Microsoft Defender for Identity | Rebranding |
66-
| `DetectionSource` | CustomDetection | Custom detection | Rebranding |
67-
| `DetectionSource` | AutomatedInvestigation |Automated investigation | Rebranding |
68-
| `DetectionSource` | ThreatExperts | Microsoft Threat Experts | Rebranding |
69-
| `DetectionSource` | 3rd party TI | 3rd Party sensors | Rebranding |
70-
| `ServiceSource` | Microsoft Defender ATP| Microsoft Defender for Endpoint | Rebranding |
71-
|`ServiceSource` |Microsoft Threat Protection | Microsoft Defender XDR | Rebranding |
72-
| `ServiceSource` | Office 365 ATP |Microsoft Defender for Office 365 | Rebranding |
73-
| `ServiceSource` |Azure ATP |Microsoft Defender for Identity | Rebranding |
48+
## March 2021
7449

75-
`DetectionSource` is available in the [AlertInfo](advanced-hunting-alertinfo-table.md) table. `ServiceSource` is available in the [AlertEvidence](advanced-hunting-alertevidence-table.md) and [AlertInfo](advanced-hunting-alertinfo-table.md) tables.
50+
The `DeviceTvmSoftwareInventoryVulnerabilities` table has been deprecated. Replacing it are the `DeviceTvmSoftwareInventory` and `DeviceTvmSoftwareVulnerabilities` tables.
7651

7752
## February 2021
7853

@@ -98,13 +73,38 @@ In the [`IdentityInfo`](advanced-hunting-identityinfo-table.md) table, the `Sour
9873
| `DeviceEvents` | `UsbDriveUnmount` | `UsbDriveUnmounted` | Customer feedback |
9974
| `DeviceEvents` | `WriteProcessMemoryApiCall` | `WriteToLsassProcessMemory` | Customer feedback |
10075

101-
## March 2021
76+
## January 2021
10277

103-
The `DeviceTvmSoftwareInventoryVulnerabilities` table has been deprecated. Replacing it are the `DeviceTvmSoftwareInventory` and `DeviceTvmSoftwareVulnerabilities` tables.
78+
| Column name | Original value name | New value name | Reason for change
79+
|--|--|--|--|
80+
| `DetectionSource` | Defender for Cloud Apps | Microsoft Defender for Cloud Apps | Rebranding |
81+
| `DetectionSource` | WindowsDefenderAtp| EDR| Rebranding |
82+
| `DetectionSource` | WindowsDefenderAv | Antivirus | Rebranding |
83+
| `DetectionSource` | WindowsDefenderSmartScreen | SmartScreen | Rebranding |
84+
| `DetectionSource` | CustomerTI | Custom TI | Rebranding |
85+
| `DetectionSource` | OfficeATP | Microsoft Defender for Office 365 | Rebranding |
86+
| `DetectionSource` | MTP | Microsoft Defender XDR | Rebranding |
87+
| `DetectionSource` | AzureATP | Microsoft Defender for Identity | Rebranding |
88+
| `DetectionSource` | CustomDetection | Custom detection | Rebranding |
89+
| `DetectionSource` | AutomatedInvestigation |Automated investigation | Rebranding |
90+
| `DetectionSource` | ThreatExperts | Microsoft Threat Experts | Rebranding |
91+
| `DetectionSource` | 3rd party TI | 3rd Party sensors | Rebranding |
92+
| `ServiceSource` | Microsoft Defender ATP| Microsoft Defender for Endpoint | Rebranding |
93+
|`ServiceSource` |Microsoft Threat Protection | Microsoft Defender XDR | Rebranding |
94+
| `ServiceSource` | Office 365 ATP |Microsoft Defender for Office 365 | Rebranding |
95+
| `ServiceSource` |Azure ATP |Microsoft Defender for Identity | Rebranding |
10496

105-
## May 2021
97+
`DetectionSource` is available in the [AlertInfo](advanced-hunting-alertinfo-table.md) table. `ServiceSource` is available in the [AlertEvidence](advanced-hunting-alertevidence-table.md) and [AlertInfo](advanced-hunting-alertinfo-table.md) tables.
98+
99+
100+
## December 2020
101+
102+
| Table name | Original column name | New column name | Reason for change
103+
|--|--|--|--|
104+
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailAction` | `EmailAction` | Customer feedback |
105+
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicy` | `EmailActionPolicy` | Customer feedback |
106+
| [EmailEvents](advanced-hunting-emailevents-table.md) | `FinalEmailActionPolicyGuid` | `EmailActionPolicyGuid` | Customer feedback |
106107

107-
The `AppFileEvents` table has been deprecated. The `CloudAppEvents` table includes information that used to be in the `AppFileEvents` table, along with other activities in cloud services.
108108

109109
## Related topics
110110
- [Advanced hunting overview](advanced-hunting-overview.md)

0 commit comments

Comments
 (0)