Skip to content

Commit c1e5b66

Browse files
padmagit77padmagit77
authored
Merge pull request #1966 from MicrosoftDocs/samanthagy-tvmtables
TVM tables
2 parents 25d1069 + 6a9ec9b commit c1e5b66

9 files changed

+408
-4
lines changed

‎defender-xdr/TOC.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -305,7 +305,13 @@
305305
- name: CloudAuditEvents
306306
href: advanced-hunting-cloudauditevents-table.md
307307
- name: CloudProcessEvents
308-
href: advanced-hunting-cloudprocessevents-table.md
308+
href: advanced-hunting-cloudprocessevents-table.md
309+
- name: DeviceBaselineComplianceAssessment
310+
href: advanced-hunting-devicebaselinecomplianceassessment-table.md
311+
- name: DeviceBaselineComplianceAssessmentKB
312+
href: advanced-hunting-devicebaselinecomplianceassessmentkb-table.md
313+
- name: DeviceBaselineComplianceProfiles
314+
href: advanced-hunting-devicebaselinecomplianceprofiles-table.md
309315
- name: DeviceEvents
310316
href: advanced-hunting-deviceevents-table.md
311317
- name: DeviceFileCertificateInfo
@@ -326,6 +332,12 @@
326332
href: advanced-hunting-deviceprocessevents-table.md
327333
- name: DeviceRegistryEvents
328334
href: advanced-hunting-deviceregistryevents-table.md
335+
- name: DeviceTvmBrowserExtensions
336+
href: advanced-hunting-devicetvmbrowserextensions-table.md
337+
- name: DeviceTvmBrowserExtensionsKB
338+
href: advanced-hunting-devicetvmbrowserextensionskb-table.md
339+
- name: DeviceTvmCertificateInfo
340+
href: advanced-hunting-devicetvmcertificateinfo-table.md
329341
- name: DeviceTvmHardwareFirmware
330342
href: advanced-hunting-devicetvmhardwarefirmware-table.md
331343
- name: DeviceTvmInfoGathering

‎defender-xdr/advanced-hunting-cloudauditevents-table.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ ms.topic: reference
2121
ms.date: 12/29/2023
2222
---
2323

24-
# CloudAuditEvents
24+
# CloudAuditEvents (Preview)
2525

2626
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
2727

‎defender-xdr/advanced-hunting-devicebaselinecomplianceassessment-table.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: DeviceBaselineComplianceAssessment table in the advanced hunting schema
3+
description: Learn about the baseline compliance assessment snapshot, indicating the status of various security configurations related to baseline profiles on devices in Microsoft Defender XDR.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: v-sgoyagoy
10+
author: samanthagy
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 11/20/2024
22+
---
23+
24+
# DeviceBaselineComplianceAssessment (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
29+
**Applies to:**
30+
- Microsoft Defender XDR
31+
- Microsoft Defender for Endpoint
32+
33+
> [!IMPORTANT]
34+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35+
36+
The `DeviceBaselineComplianceAssessment` table in the advanced hunting schema contains baseline compliance assessment snapshot, which indicates the status of various security configurations related to baseline profiles on devices.
37+
38+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
39+
40+
| Column name | Data type | Description |
41+
|-------------|-----------|-------------|
42+
| `DeviceId` | `string` | Unique identifier for the device in the service |
43+
| `DeviceName` | `string` | Fully qualified domain name (FQDN) of the device |
44+
| `OSPlatform` | `string` | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10 and Windows 7. |
45+
| `OSVersion` | `string` | Version of the operating system running on the device |
46+
| `ConfigurationId` | `string` | Unique identifier for a specific configuration |
47+
| `ProfileId` | `string` | Unique identifier for the profile |
48+
| `IsCompliant` | `boolean` | Indicates whether the device that initiated the event is compliant or not |
49+
| `IsApplicable` | `boolean` | Indicates whether the configuration or policy is applicable |
50+
| `Source` | `dynamic` | The registry path or other location used to determine the current device setting |
51+
| `RecommendedValue` | `dynamic` | Set of expected values for the current device setting to be compliant |
52+
| `CurrentValue` | `dynamic` | Set of detected values found on the device |
53+
| `IsExempt` | `boolean` | Indicates whether the device is exempt from having the baseline configuration |
54+
55+
56+
## Related topics
57+
58+
- [Proactively hunt for threats](advanced-hunting-overview.md)
59+
- [Learn the query language](advanced-hunting-query-language.md)
60+
- [Understand the schema](advanced-hunting-schema-tables.md)
61+
- [Apply query best practices](advanced-hunting-best-practices.md)
62+
- [Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
63+
64+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicebaselinecomplianceassessmentkb-table.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
title: DeviceBaselineComplianceAssessmentKB table in the advanced hunting schema
3+
description: Learn about the various security configurations used by baseline compliance to assess devices in the DeviceBaselineComplianceAssessmentKB table in the advanced hunting schema.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: v-sgoyagoy
10+
author: samanthagy
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 11/20/2024
22+
---
23+
24+
# DeviceBaselineComplianceAssessmentKB (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
29+
**Applies to:**
30+
- Microsoft Defender XDR
31+
- Microsoft Defender for Endpoint
32+
33+
> [!IMPORTANT]
34+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35+
36+
The `DeviceBaselineComplianceAssessmentKB` table in the advanced hunting schema contains information about various security configurations used by baseline compliance to assess devices.
37+
38+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
39+
40+
| Column name | Data type | Description |
41+
|-------------|-----------|-------------|
42+
| `ConfigurationId` | `string` | Unique identifier for a specific configuration |
43+
| `ConfigurationName` | `string` | Display name of the configuration |
44+
| `ConfigurationDescription` | `string` | Description of the configuration |
45+
| `ConfigurationRationale` | `string` | Description of any associated risks and rationale behind the configuration |
46+
| `ConfigurationCategory` | `string` | Category or grouping to which the configuration belongs |
47+
| `BenchmarkProfileLevels` | `dynamic` | List of benchmark compliance levels for which the configuration is applicable |
48+
| `CCEReference` | `string` | Unique Common Configuration Enumeration (CCE) identifier for the configuration |
49+
| `RemediationOptions` | `string` | Recommended actions to reduce or address any associated risks |
50+
| `ConfigurationBenchmark` | `string` | Industry benchmark recommending the configuration |
51+
| `Source` | `dynamic` | The registry path or other location used to determine the current device setting |
52+
| `RecommendedValue` | `dynamic` | Set of expected values for the current device setting to be compliant |
53+
54+
55+
## Related topics
56+
57+
- [DeviceBaselineComplianceAssessment](advanced-hunting-devicebaselinecomplianceassessment-table.md)
58+
- [Understand the schema](advanced-hunting-schema-tables.md)
59+
- [Apply query best practices](advanced-hunting-best-practices.md)
60+
- [Overview of Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
61+
62+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicebaselinecomplianceprofiles-table.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: DeviceBaselineComplianceProfiles table in the advanced hunting schema
3+
description: Learn about the baseline profiles used for monitoring device baseline compliance in the DeviceBaselineComplianceProfiles table in the advanced hunting schema.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: v-sgoyagoy
10+
author: samanthagy
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 11/20/2024
22+
---
23+
24+
# DeviceBaselineComplianceProfiles (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
29+
**Applies to:**
30+
- Microsoft Defender XDR
31+
- Microsoft Defender for Endpoint
32+
33+
> [!IMPORTANT]
34+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35+
36+
The `DeviceBaselineComplianceProfiles` table in the advanced hunting schema contains baseline profiles used for monitoring device baseline compliance. Use this reference to construct queries that return information from the table.
37+
38+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
39+
40+
| Column name | Data type | Description |
41+
|-------------|-----------|-------------|
42+
| `ProfileId` | `string` | Unique identifier for the profile |
43+
| `ProfileName` | `string` | Display name of the profile |
44+
| `ProfileDescription` | `string` | Optional description providing additional information related to the profile |
45+
| `OSPlatform` | `dynamic` | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10 and Windows 7. |
46+
| `OSVersion` | `string` | Version of the operating system running on the device |
47+
| `BaseBenchmark` | `string` | Industry benchmark on top of which the profile was created |
48+
| `BenchmarkVersion` | `string` | Version of the industry benchmark on top of which the profile was created |
49+
| `BenchmarkProfileLevel` | `string` | Benchmark compliance level set for the profile |
50+
| `Status` | `boolean` | Indicator of the profile status - can be Enabled or Disabled |
51+
| `CreatedBy` | `string` | Identity of the user account who created the profile |
52+
| `CreatedOn` | `datetime` | Date and time when the profile was created |
53+
| `LastUpdatedBy` | `string` | Identity of the user account who last updated the profile |
54+
| `LastUpdatedOn` | `datetime` | Date and time when the profile was last updated |
55+
56+
57+
## Related topics
58+
59+
- [Proactively hunt for threats](advanced-hunting-overview.md)
60+
- [Understand the schema](advanced-hunting-schema-tables.md)
61+
- [Apply query best practices](advanced-hunting-best-practices.md)
62+
- [Overview Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
63+
64+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicetvmbrowserextensions-table.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: DeviceTvmBrowserExtensions table in the advanced hunting schema
3+
description: Learn about browser extension installations found on devices as shown in Microsoft Defender Vulnerability Management.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: v-sgoyagoy
10+
author: samanthagy
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 11/20/2024
22+
---
23+
24+
# DeviceTvmBrowserExtensions (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
**Applies to:**
29+
- Microsoft Defender XDR
30+
- Microsoft Defender for Endpoint
31+
32+
> [!IMPORTANT]
33+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
34+
35+
Each row in the `DeviceTvmBrowserExtensions` table contains information about browser extension installations found on devices from [Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt).
36+
37+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
38+
39+
| Column name | Data type | Description |
40+
|-------------|-----------|-------------|
41+
| `DeviceId` | `string` | Unique identifier for the device in the service |
42+
| `BrowserName` | `string` | Name of the web browser with the extension |
43+
| `ExtensionId` | `string` | Unique identifier for the browser extension |
44+
| `ExtensionName` | `string` | Name of the extension |
45+
| `ExtensionDescription` | `string` | Description from the publisher about the extension |
46+
| `ExtensionVersion` | `string` | Version number of the extension |
47+
| `ExtensionRisk` | `string` | Risk level for the extension based on the permissions it has requested |
48+
| `ExtensionVendor` | `string` | Name of the vendor offering the extension |
49+
| `IsActivated` | `string` | Whether the extension is turned on or off on the devices |
50+
| `InstallationTime` | `datetime` | Date and time when the browser extension was first installed |
51+
52+
53+
## Related topics
54+
55+
- [Proactively hunt for threats](advanced-hunting-overview.md)
56+
- [Learn the query language](advanced-hunting-query-language.md)
57+
- [Use shared queries](advanced-hunting-shared-queries.md)
58+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
59+
- [Understand the schema](advanced-hunting-schema-tables.md)
60+
- [Apply query best practices](advanced-hunting-best-practices.md)
61+
- [Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
62+
63+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicetvmbrowserextensionskb-table.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: DeviceTvmBrowserExtensionsKB table in the advanced hunting schema
3+
description: Learn about the various browser extension details and permission information used in the Microsoft Defender Vulnerability Management browser extensions page in the DeviceTvmBrowserExtensionsKB table in the advanced hunting schema.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: v-sgoyagoy
10+
author: samanthagy
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
ms.topic: reference
21+
ms.date: 11/20/2024
22+
---
23+
24+
# DeviceTvmBrowserExtensionsKB (Preview)
25+
26+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
27+
28+
29+
**Applies to:**
30+
- Microsoft Defender XDR
31+
- Microsoft Defender for Endpoint
32+
33+
> [!IMPORTANT]
34+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
35+
36+
The `DeviceTvmBrowserExtensionsKB` table in the advanced hunting schema contains information about browser extension details and permission information used in [Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) browser extensions page.
37+
38+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
39+
40+
| Column name | Data type | Description |
41+
|-------------|-----------|-------------|
42+
| `BrowserName` | `string` | Name of the web browser with the extension |
43+
| `ExtensionId` | `string` | Unique identifier for the browser extension |
44+
| `ExtensionName` | `string` | Name of the extension |
45+
| `ExtensionDescription` | `string` | Description from the publisher about the extension |
46+
| `ExtensionVersion` | `dynamic` | Version number of the extension |
47+
| `ExtensionRisk` | `string` | Risk level for the extension based on the permissions it has requested |
48+
| `PermissionId` | `string` | Unique identifier for the permission |
49+
| `PermissionName` | `string` | Name given to each permission based on what the extension is asking for |
50+
| `PermissionDescription` | `string` | Explanation of what the permission is supposed to do |
51+
| `PermissionRisk` | `string` | Risk level for the permission based on the type of access it would allow |
52+
| `IsPermissionRequired` | `string` | Whether the permission is required for the extension to run, or optional |
53+
54+
55+
## Related topics
56+
57+
- [Proactively hunt for threats](advanced-hunting-overview.md)
58+
- [Learn the query language](advanced-hunting-query-language.md)
59+
- [Use shared queries](advanced-hunting-shared-queries.md)
60+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
61+
- [Understand the schema](advanced-hunting-schema-tables.md)
62+
- [Apply query best practices](advanced-hunting-best-practices.md)
63+
- [Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
64+
65+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

0 commit comments

Comments
 (0)