You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
> Some information relates to prereleased product which might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32
+
33
+
30
34
The `DisruptionAndResponseEvents` table in the [advanced hunting](advanced-hunting-overview.md) contains information about [automatic attack disruption](automatic-attack-disruption.md) events in Microsoft Defender XDR. These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads.
31
35
32
36
Users can use this table to increase their visibility and awareness of active, complex attacks disrupted by automatic attack disruption. Understanding the scope of even complex attacks, their context, impact, and why disruption actions were taken, can help users make better and faster decisions and allocate resources more efficiently.
@@ -44,40 +48,41 @@ For information on other tables in the advanced hunting schema, [see the advance
44
48
| Column name | Data type | Description |
45
49
|-------------|-----------|-------------|
46
50
|`Timestamp`|`datetime`| Date and time when the event was recorded |
47
-
|`ActionType`|`string`| Type of disruption action taken |
51
+
|`ActionType`|`string`| Type of disruption action taken, for example: ContainedUserLogonBlocked, ContainedUserSmbFileOpenBlocked, SafeBootGuardApplied |
48
52
|`DeviceId`|`string`| Unique identifier for the device that reported the event; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack |
49
53
|`SourceDeviceId`|`string`| Unique identifier for the device that the attack originated from |
50
54
|`TargetDeviceId`|`string`| Unique identifier for the device that was targeted or attacked |
51
-
|`TargetDeviceName `|`string`| Name of the device that the compromised account attempted to access |
52
-
|`TargetDomainName `|`string`| Domain name of the device that the compromised account attempted to access|
55
+
|`TargetDeviceName `|`string`| Name of the device that was targeted or attacked|
56
+
|`TargetDomainName `|`string`| Domain name of the device that was targeted or attacked|
53
57
|`DeviceName`|`string`| Name of the device that reported the event; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack |
54
58
|`DomainName`|`string`| Domain name that the device that reported the event is joined to; the reporting device can be the one that blocked the access, the compromised device itself, or even a different device that is aware of the attack |
55
-
|`InitiatingProcessId`|`integer`| Process ID (PID) of the process that triggered that block action, based on the perspective of the device that logged the event |
56
-
|`InitiatingProcessFileName`|`string`|Name of the process that triggered the block action, based on the perspective of the device that logged the event |
57
-
|`SourceUserSid`|`string`| The security identifier of the account where the attack originated from|
58
-
|`SourceUserName`|`string`| The user name of the account where the attack originated from|
59
-
|`SourceUserDomainName`|`string`| The domain name of the account where the attack originated from |
60
-
|`SourceIPAddress`|`string`| IP address where the attacker communication came from, if the IP was not blocked by automatic attack disruption |
61
-
|`SourcePort`|`integer`| Port where the attacker communication came from |
62
-
|`IPAddress`|`string`| IP address that was blocked by automatic attack disruption |
63
-
|`Port`|`string`| Port that was blocked by automatic attack disruption |
64
-
|`SourceDeviceName`|`string`| Host name of the device where the attack came from |
65
-
|`SourceDomainName`|`string`| Domain name of the attacker device |
59
+
|`InitiatingProcessId`|`integer`| Process ID (PID) of the process that triggered that block action, based on the perspective of the reporting device|
60
+
|`InitiatingProcessFileName`|`string`|Name of the process that triggered the block action, based on the perspective of the reporting device|
61
+
|`SourceUserSid`|`string`| The security identifier of the account conducting the malicious activity|
62
+
|`SourceUserName`|`string`| The user name of the account conducting the malicious activity|
63
+
|`SourceUserDomainName`|`string`| The domain name of the account conducting the malicious activity|
64
+
|`SourceIPAddress`|`string`| IP address where the attacker communication originated from and was blocked by automatic attack disruption |
65
+
|`SourcePort`|`integer`| Port where the attacker communication originated from |
66
+
|`IPAddress`|`string`| IP address that the attacker attempted to access|
67
+
|`Port`|`string`| Port that the attacker attempted to access|
68
+
|`SourceDeviceName`|`string`| Host name of the device where the attack originated from |
69
+
|`SourceDomainName`|`string`| Domain name of the device where the attack originated from|
66
70
|`AuthenticationProtocol`|`string`| Authentication protocol that the compromised user used to sign in; possible values: Undefined, NTLM, Kerberos |
67
-
|`Service`|`string`| Name of the service the attacker attempted to use, if the attacker signed in using Kerberos or NTLM|
71
+
|`Service`|`string`| Name of the service the attacker attempted to use, if the attacker signed in using Kerberos or NTLM; for example: SMB, HTTP, cifs, SMB, host, ldap, SMB, krbtgt|
68
72
|`InterfaceUuidSourceDomainName`|`string`| Unique identifier (UUID) for the Remote Procedure Call (RPC) interface that the attacker attempted to access |
69
73
|`InterfaceFriendlyName`|`string`|Friendly name of the interface represented by the interface UUID |
70
74
|`FileName`|`string`| Name of the file that the attacker attempted to access |
71
75
|`ShareName`|`string`| Name of the share location that the attacker attempted to access |
72
76
|`LogonType`|`string`| Type of logon session the user attempted; possible values: interactive, remote interactive (RDP), network, batch job, service |
73
-
|`LogonId `|`long`| Identifier for a logon session. This identifier is unique on the same device only between restarts. |
74
-
|`SessionId `|`long`|Domain name of the attacker device|
77
+
|`LogonId `|`long`| Identifier for a logon session; this is unique on the same device only between restarts |
78
+
|`SessionId `|`long`|Unique number assigned to a user by a website's server for the duration of the visit or session|
75
79
|`CompromisedAccountCount`|`integer`| Number of compromised accounts that are part of the policy |
76
80
|`PolicyId`|`string`| Unique identifier for the policy |
77
81
|`PolicyName`|`string`| Name of the policy |
78
-
|`PolicyVersion`|`string`| Version of the policy Version of the policy|
82
+
|`PolicyVersion`|`string`| Version of the policy |
79
83
|`PolicyHash`|`string`| Unique hash of the policy |
80
-
|`DataSources`|`array`|Products or services that provided information for the event |
84
+
|`DataSources`|`array`|Products or services that provided information for the event; for example: Microsoft Defender for Endpoint |
85
+
|`IsPolicyOn`|`boolean`|Indicates the current state of the policy on the device at the time of the disruption event; possible values: true (the policy is on, therefore it was applied or enforced), false (the policy was turned off or revoked from the device) |
0 commit comments