Skip to content

Commit afafb91

Browse files
schmurkyschmurky
committed
New tables
1 parent 745f0f6 commit afafb91

File tree

2 files changed

+203
-0
lines changed

2 files changed

+203
-0
lines changed

‎defender-xdr/advanced-hunting-datasecuritybehaviors-table.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
title: DataSecurityBehaviors table in the advanced hunting schema
3+
description: Learn about the DataSecurityBehaviors table of the advanced hunting schema, which contains insights about potentially suspicious user behaviors that violate the customer defined or default policies configured in the Microsoft Purview suite of solutions.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 02/11/2025
22+
---
23+
24+
# DataSecurityBehaviors (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
**Applies to:**
29+
30+
- Microsoft Defender XDR
31+
- Microsoft Purview
32+
33+
34+
35+
> [!IMPORTANT]
36+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
37+
38+
The `DataSecurityBehaviors` table in the [advanced hunting](advanced-hunting-overview.md) schema contains insights about potentially suspicious user behaviors that violate the customer defined or default policies configured in the Microsoft Purview suite of solutions.
39+
40+
Insights cover a range of data security related behaviors like behaviors involving exfiltration, obfuscation, risky interactions with AI applications, and others. Insights are generated by aggregating user behaviors over a calendar day and comparing them with previous activity, peer group activity, or other activities done by the user. Insights also capture summaries of various risk pivots like sensitive data, risky destinations, and the like.
41+
42+
Use this reference to construct queries that return information from this table.
43+
44+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
45+
46+
| Column name | Data type | Description |
47+
|-------------|-----------|-------------|
48+
|`Timestamp` | `datetime` | Date and time when the record was generated or updated |
49+
|`BehaviorId` | `string` | Unique identifier for the behavior |
50+
|`ActionType`| `string`|Type of behavior. Refer to the catalog of behaviors detected by Microsoft Purview Insider Risk Management |
51+
|`StartTime`| `datetime` |Date and time of the first activity related to the behavior|
52+
|`EndTime`| `datetime`| Date and time of the last activity related to the behavior|
53+
|`AttackTechniques`| `string`| MITRE ATT&CK techniques associated with the activity that triggered the behavior. Refer to subtechniques in the insider risk management behavior catalog.|
54+
|`Categories`| `string`| Type of threat indicator or breach activity identified by the behavior|
55+
|`ActivityType`| `enum`| Activity category based on categories in Microsoft Purview Insider Risk Management|
56+
|`Description`| `string`| Description of the behavior|
57+
|`ServiceSource`| `string`| Product or service that identified the behavior|
58+
|`DetectionSource`| `string`| Detection technology or sensor that identified the notable component or activity|
59+
|`ActivityCount`| `int`| Total user activity events recorded under this behavior|
60+
|`IsAnomalous`| `bool`| Indicates if this user behavior is anomalous by itself or based on insider risk management global settings|
61+
|`IsContentHidden`| `bool`| Indicates if the behavior involves hidden content on a device|
62+
|`AccountUpn`| `string`| User principal name (UPN) of the account|
63+
|`AccountEmail`| `string`| Email address of the account|
64+
|`Application`| `string` |Application that performed the recorded action|
65+
|`DeviceInfo`| `string`| List of device information for the device involved in this behavior, including device ID, device name, and the number of events in which the device is involved; displayed in JSON array format|
66+
|`SensitivityLabelInfo`| `string`| List of sensitivity labels assigned to content involved in this behavior, including the unique identifier for the Microsoft Information Protection sensitivity label assigned to the related content, the name of the sensitivity label, and the number of events in the behavior involving this label; displayed in JSON array format|
67+
|`SensitiveInfoTypesInfo`| `string` |List of sensitive info types detected in the content involved in this behavior, including the unique identifier for the sensitive info type, the name of the sensitive info type, and the number of events in the behavior involving this sensitive info type; displayed in JSON array format|
68+
|`UrlDomainInfo`| `string`| List of websites or service URLs involved in the behavior, including the name of the URL domain, the direction of data (sent or received from domain), type of URL domain (customer-configured or based on watchlists), and the number of events in the behavior involving the specific domain; displayed in JSON array format|
69+
|`SharepointSiteInfo`| `string`| List of SharePoint sites involved in this behavior, including the unique identifier for the SharePoint site, the name of the SharePoint site, and the number of events in the behavior involving the SharePoint site; displayed in JSON array format|
70+
|`RecipientEmailInfo`| `string`| List of information about the recipient involved in the behavior, including the email address of the recipient and the number of events in the behavior involving the recipient; displayed in JSON array format|
71+
|`RemovableMediaInfo`| `string`| List of any removable media involved in the behavior, including the serial number of the removable media device, the manufacturer of the removable media device, and the model of the removable device; displayed in JSON array format|
72+
|`PrinterName`| `string` |List of printers involved in the behavior; displayed in array format|
73+
|`PolicyMatchInfo` |`string`| List of insider risk management policy matches with this behavior, including the unique identifier and the name of the policy configured in Microsoft Insider Risk Management, the number of events in this behavior that matches priority content defined in the insider risk management policy, and the risk score assigned to this behavior by specific policies; displayed in JSON array format|
74+
75+
## Related articles
76+
77+
- [Advanced hunting overview](advanced-hunting-overview.md)
78+
- [Learn the query language](advanced-hunting-query-language.md)
79+
- [Use shared queries](advanced-hunting-shared-queries.md)
80+
- [Understand the schema](advanced-hunting-schema-tables.md)
81+
- [Apply query best practices](advanced-hunting-best-practices.md)
82+
83+
84+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-datasecurityevents-table.md‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
---
2+
title: DataSecurityEvents table in the advanced hunting schema
3+
description: Learn about the DataSecurityBehaviors table of the advanced hunting schema, which contains information about user activities that violate customer defined or default policies in Microsoft Purview suite of solutions.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 02/11/2025
22+
---
23+
24+
# DataSecurityEvents (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
**Applies to:**
29+
30+
- Microsoft Defender XDR
31+
- Microsoft Purview
32+
33+
34+
35+
> [!IMPORTANT]
36+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
37+
38+
The `DataSecurityBehaviors` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user activities that violate customer defined or default policies in Microsoft Purview suite of solutions. Each record represents a single user activity enriched with proprietary Microsoft detections (like sensitive info types) and customer-defined enrichment labels like domain categories, sensitivity labels, and the like.
39+
40+
Use this reference to construct queries that return information from this table.
41+
42+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
43+
44+
| Column name | Data type | Description |
45+
|-------------|-----------|-------------|
46+
|`Application`| `string`|Application that performed the recorded action|
47+
|`DeviceId`| `string`| Device ID provided by Microsoft Defender for Endpoint|
48+
|`DeviceName`| `string`| Fully Qualified Domain Name(FQDN) of the device|
49+
|`AadDeviceId`| `guid`| Unique identifier for the device in the Azure Active Directory on which the activity was performed|
50+
|`IsManagedDevice`| `bool`| Indicates if the device is managed by the organization|
51+
|`DlpPolicyMatchInfo`| `string`| Information around the list of DLP policies matching this event; displayed in JSON array format|
52+
|`DLPPolicyEnforcementMode`| `int`| Indicates whether the DLP enforcement mode is one of audit/warn(block with override)/block/allow(audit without alerts)|
53+
|`DlpPolicyRuleMatchInfo`| `string`| Details of DLP policy rules that matched with this event; displayed in JSON array format|
54+
|`FileRenameInfo`|`string`| Details of the file prior to this event|
55+
|`PreviousFileName` |`string`|Details of the file prior to this event|
56+
|`PrevioudFileExtension`|`string`| Extension of the file prior to this event|
57+
|`PhysicalAccessPointId`| `string`| Unique identifier for the Physical access point|
58+
|`PhysicalAccessPointName`| `string`| Name of the Physical access point|
59+
|`PhysicalAccessStatus` |`string`| The status of physical access whether it succeeded or failed|
60+
|`PhysicalAssetTag`|`string` |The tag assigned to the asset as per the config defined in Microsoft Insider Risk Management global settings|
61+
|`RemovableMediaManufacturer`|`string`| The manufacturer name of the removable device|
62+
|`RemovableMediaModel`| `string`| The model name of the removable device|
63+
|`RemovableMediaSerialNumber`| `string`|The serial number of the removable device|
64+
|`TeamsChannelName`|`string`| Name of the teams channel|
65+
|`TeamsChannelType`| `string`g| Type of the teams channel|
66+
|`TeamsTeamName`| `string` |Name of the team|
67+
|`UserAlternateEmails`| `string`| Comma separated string of alternate mails or aliases of user|
68+
|`AccountUpn`| `string`| User principal name (UPN) of the account|
69+
|`AccountObjectId`| `string`| Unique identifier for the account in Microsoft Entra ID|
70+
|`Department`|`string`| Department of the user/actor|
71+
|`SourceCodeInfo`| `string`| Captures the details of the source code in related activities|
72+
|`CcPolicyMatchInfo`| JSON object | xxx
73+
|`IPAddress`| `string`| Comma separated string of IP Addresses of the clients on which the activity was performed. This can contain multiple IPs if the activity is related to MCAS alerts.|
74+
|`Timestamp`| `datetime`| Time stamp of the event|
75+
|DeviceSourceLocationType| `int`| Type of the source location for endpoint signals. Represented by a resolved enum value|
76+
|`DeviceDestinationLocationType`| Int| Destination location of the activity. Represented by a resolved enum value|
77+
|`IrmPolicyMatchInfo`| JSON Object| xxx |
78+
|`UnallowedUrlDomains`| `string`| List of websites, service URLs involved in this event that are configured as Unallowed in IRM Global settings|
79+
|`ExternalUrlDomains`| `string`| List of websites, service URLs involved in this event that are classified as external in IRM Global settings|
80+
|`UrlDomainInfo`| `string`| List of websites, service URLs in the behavior involved in the behavior|
81+
|`SourceUrlDomain`| `string`| Originating domain for the endpoint and email signals|
82+
|`TargetUrlDomain`| `string`| Details of the target domain that content is shared with or user has browsed to|
83+
|`EmailAttachmentCount`|`int`| xxx |
84+
|`EmailAttachmentInfo`| Array<JSON Object>| Details of email attachments|
85+
|`InternetMessageId`|`string` |The internet message id of the entity related to email or teams message. This field is relevant to exchange infra |
86+
|`NetworkMessageId`| `guid`| The network message id of the entity related to email. This field is relevant to exchange infra |
87+
|`EmailSubject`| `string`| Subject of the email|
88+
|`ObjectId`| `string` |File full path (URL). For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For MCAS alerts it is the alert id. For emails it is internet message id.|
89+
|`ObjectName`| `string`| Name on the item on which the activity was done. In case of files it includes the extension also.|
90+
|`ObjectType`| `string`| A unique enumeration value indicates type included in the activity.|
91+
|`ObjectSize`| `int`| Size of the item in bytes.|
92+
|`IsHidden`| `bool`| Indicates whether the user marks the content as hidden.
93+
|`Id` |`guid`| Unique id of the activity log|
94+
|`ActionType`|`string`| This field gives a more verbose context around the type of activity done as per the audit operation and some specific fields (in case of few specific operation). This is a comma separated list which might have multiple activity description for some particular activities like for FileCreated operation it can be "Hidden File Created" or "Sensitive File Created" or both.|
95+
|`SensitiveInfoTypeInfo`| Array<JSON Object>| Information regarding the DLP sensitive information.|
96+
|`SensitivtyLabelIds`|`string`| The current MIP sensitivity label ID associated with the item.|
97+
|`SharepointSiteSensitivityLabelIds`|`string`| The MIP sensitivity label ID assigned to the parent site of the item related to SharePoint activities.|
98+
|`PreviousSensitivityLabelId`| `string`| The old MIP sensitivity label Id for the item in case of activities where sensitive label was changed like SpoFileLabelDowngraded, SpoFileLabelRemoved, SpoSiteLabelRemoved.|
99+
|`Operation`| `string`| The name of the admin activity.|
100+
|`RecipientEmailAddress`| `string`| Comma separated list of recipients for the corresponding activity. It could be the recipients of email, SharePoint shared items, teams message, teams channel member addition action etc.|
101+
|`SiteUrl`| `string` | xxx |
102+
|`SourceRelativeUrl`| `string`| xxx |
103+
|`TargetFilePath`| `string`| Target file path for end point activities.|
104+
|`PrinterName`| `string`| List of printers involved in the behavior|
105+
|`Workload`|`string`| The Microsoft 365 service where the activity occurred.|
106+
|`IrmActionCategory`| `enum`| A unique enumeration value indicating the activity category in Microsoft Purview Insider risk management.|
107+
|`SequenceCorrelationId`| xx |Details of the sequence activity|
108+
109+
110+
## Related articles
111+
112+
- [Advanced hunting overview](advanced-hunting-overview.md)
113+
- [Learn the query language](advanced-hunting-query-language.md)
114+
- [Use shared queries](advanced-hunting-shared-queries.md)
115+
- [Understand the schema](advanced-hunting-schema-tables.md)
116+
- [Apply query best practices](advanced-hunting-best-practices.md)
117+
118+
119+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

0 commit comments

Comments
 (0)