|
1 | 1 | --- |
2 | 2 | title: DataSecurityEvents table in the advanced hunting schema |
3 | | -description: Learn about the DataSecurityBehaviors table of the advanced hunting schema, which contains information about user activities that violate customer defined or default policies in Microsoft Purview suite of solutions. |
4 | | -search.appverid: met150 |
| 3 | +description: Learn about the DataSecurityEvents table of the advanced hunting schema, which contains information about user activities that violate user-defined or default policies in the Microsoft Purview suite of solutions. |
5 | 4 | ms.service: defender-xdr |
6 | 5 | ms.subservice: adv-hunting |
7 | 6 | f1.keywords: |
@@ -35,76 +34,74 @@ ms.date: 02/11/2025 |
35 | 34 | > [!IMPORTANT] |
36 | 35 | > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. |
37 | 36 |
|
38 | | -The `DataSecurityBehaviors` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user activities that violate customer defined or default policies in Microsoft Purview suite of solutions. Each record represents a single user activity enriched with proprietary Microsoft detections (like sensitive info types) and customer-defined enrichment labels like domain categories, sensitivity labels, and the like. |
| 37 | +The `DataSecurityEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user activities that violate user-defined or default policies in the Microsoft Purview suite of solutions. Each log represents a single user activity enriched with proprietory Microsoft detections (like sensitive info types) and user-defined enrichment labels like domain categories, sensitivity labels, and others. |
39 | 38 |
|
40 | 39 | Use this reference to construct queries that return information from this table. |
41 | 40 |
|
42 | 41 | For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md). |
43 | 42 |
|
44 | 43 | | Column name | Data type | Description | |
45 | 44 | |-------------|-----------|-------------| |
46 | | -|`Application`| `string`|Application that performed the recorded action| |
47 | | -|`DeviceId`| `string`| Device ID provided by Microsoft Defender for Endpoint| |
48 | | -|`DeviceName`| `string`| Fully Qualified Domain Name(FQDN) of the device| |
49 | | -|`AadDeviceId`| `guid`| Unique identifier for the device in the Azure Active Directory on which the activity was performed| |
50 | | -|`IsManagedDevice`| `bool`| Indicates if the device is managed by the organization| |
51 | | -|`DlpPolicyMatchInfo`| `string`| Information around the list of DLP policies matching this event; displayed in JSON array format| |
52 | | -|`DLPPolicyEnforcementMode`| `int`| Indicates whether the DLP enforcement mode is one of audit/warn(block with override)/block/allow(audit without alerts)| |
53 | | -|`DlpPolicyRuleMatchInfo`| `string`| Details of DLP policy rules that matched with this event; displayed in JSON array format| |
54 | | -|`FileRenameInfo`|`string`| Details of the file prior to this event| |
55 | | -|`PreviousFileName` |`string`|Details of the file prior to this event| |
56 | | -|`PrevioudFileExtension`|`string`| Extension of the file prior to this event| |
57 | | -|`PhysicalAccessPointId`| `string`| Unique identifier for the Physical access point| |
58 | | -|`PhysicalAccessPointName`| `string`| Name of the Physical access point| |
59 | | -|`PhysicalAccessStatus` |`string`| The status of physical access whether it succeeded or failed| |
60 | | -|`PhysicalAssetTag`|`string` |The tag assigned to the asset as per the config defined in Microsoft Insider Risk Management global settings| |
61 | | -|`RemovableMediaManufacturer`|`string`| The manufacturer name of the removable device| |
62 | | -|`RemovableMediaModel`| `string`| The model name of the removable device| |
63 | | -|`RemovableMediaSerialNumber`| `string`|The serial number of the removable device| |
64 | | -|`TeamsChannelName`|`string`| Name of the teams channel| |
65 | | -|`TeamsChannelType`| `string`g| Type of the teams channel| |
66 | | -|`TeamsTeamName`| `string` |Name of the team| |
67 | | -|`UserAlternateEmails`| `string`| Comma separated string of alternate mails or aliases of user| |
| 45 | +|`ApplicationNames`| `string`|List of application names used or related to the event| |
| 46 | +|`DeviceId`| `string`| Unique identifier for the device in Microsoft Defender for Endpoint| |
| 47 | +|`DeviceName`| `string`| Fully qualified domain name(FQDN) of the device| |
| 48 | +|`AadDeviceId`| `guid`| Unique identifier for the device in Microsoft Entra ID| |
| 49 | +|`IsManagedDevice`| `bool`| Indicates if the device is managed by the organization (True) or not (False)| |
| 50 | +|`DlpPolicyMatchInfo`| `string`| Information around the list of data loss prevention (DLP) policies matching this event| |
| 51 | +|`DlpPolicyEnforcementMode`| `int`| Indicates the Data Loss Prevention policy that was enforced; value can be: 0 (None), 1 (Audit), 2 (Warn), 3 (Warn and bypass), 4 (Block), 5 (Allow)| |
| 52 | +|`DlpPolicyRuleMatchInfo`| `string`| Details of the data loss prevention (DLP) rules that matched with this event; displayed in JSON array format| |
| 53 | +|`FileRenameInfo`|`string`| Details of the file (file name and extension) prior to this event| |
| 54 | +|`PhysicalAccessPointId`| `string`| Unique identifier for the physical access point| |
| 55 | +|`PhysicalAccessPointName`| `string`| Name of the physical access point| |
| 56 | +|`PhysicalAccessStatus` |`string`| Status of physical access, whether it succeeded or failed| |
| 57 | +|`PhysicalAssetTag`|`string` |Tag assigned to the asset as configured in Microsoft Insider Risk Management global settings| |
| 58 | +|`RemovableMediaManufacturer`|`string`| Manufacturer name of the removable device| |
| 59 | +|`RemovableMediaModel`| `string`| Model name of the removable device| |
| 60 | +|`RemovableMediaSerialNumber`| `string`|Serial number of the removable device| |
| 61 | +|`TeamsChannelName`|`string`| Name of the Teams channel| |
| 62 | +|`TeamsChannelType`| `string`| Type of the Teams channel| |
| 63 | +|`TeamsTeamName`| `string` |Name of the Teams team | |
| 64 | +|`UserAlternateEmails`| `string`| Alternate emails or aliases of the user| |
68 | 65 | |`AccountUpn`| `string`| User principal name (UPN) of the account| |
69 | 66 | |`AccountObjectId`| `string`| Unique identifier for the account in Microsoft Entra ID| |
70 | | -|`Department`|`string`| Department of the user/actor| |
71 | | -|`SourceCodeInfo`| `string`| Captures the details of the source code in related activities| |
72 | | -|`CcPolicyMatchInfo`| JSON object | xxx |
73 | | -|`IPAddress`| `string`| Comma separated string of IP Addresses of the clients on which the activity was performed. This can contain multiple IPs if the activity is related to MCAS alerts.| |
74 | | -|`Timestamp`| `datetime`| Time stamp of the event| |
75 | | -|DeviceSourceLocationType| `int`| Type of the source location for endpoint signals. Represented by a resolved enum value| |
76 | | -|`DeviceDestinationLocationType`| Int| Destination location of the activity. Represented by a resolved enum value| |
77 | | -|`IrmPolicyMatchInfo`| JSON Object| xxx | |
78 | | -|`UnallowedUrlDomains`| `string`| List of websites, service URLs involved in this event that are configured as Unallowed in IRM Global settings| |
79 | | -|`ExternalUrlDomains`| `string`| List of websites, service URLs involved in this event that are classified as external in IRM Global settings| |
80 | | -|`UrlDomainInfo`| `string`| List of websites, service URLs in the behavior involved in the behavior| |
81 | | -|`SourceUrlDomain`| `string`| Originating domain for the endpoint and email signals| |
82 | | -|`TargetUrlDomain`| `string`| Details of the target domain that content is shared with or user has browsed to| |
83 | | -|`EmailAttachmentCount`|`int`| xxx | |
| 67 | +|`Department`|`string`| Name of the department that the account user belongs to| |
| 68 | +|`SourceCodeInfo`| `string`| Details of the source code repository involved in the event| |
| 69 | +|`CcPolicyMatchInfo`| `JSON object` | Details of the Communications Compliance policy matches for this event | |
| 70 | +|`IpAddress`| `string`| IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts| |
| 71 | +|`Timestamp`| `datetime`| Date and time when the event was recorded| |
| 72 | +|`DeviceSourceLocationType`| `int`| Indicates the type of location where the endpoint signals originated from; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)| |
| 73 | +|`DeviceDestinationLocationType`| Int| Indicates the type of location where the endpoint signals connected to; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)| |
| 74 | +|`IrmPolicyMatchInfo`| `JSON Object`| Details of Insider Risk Management policy matches for the content involved in the event | |
| 75 | +|`UnallowedUrlDomains`| `string`| Websites or service URLs involved in this event that are configured as Unallowed in Insider Risk Management global settings| |
| 76 | +|`ExternalUrlDomains`| `string`| Websites or service URLs involved in this event that are classified as External in Insider Risk Management global settings| |
| 77 | +|`UrlDomainInfo`| `string`| Details about the websites or service URLs involved in the event| |
| 78 | +|`SourceUrlDomain`| `string`| Domain where the device and email signals originated| |
| 79 | +|`TargetUrlDomain`| `string`| Domain where the content was shared with or the user has browsed to| |
| 80 | +|`EmailAttachmentCount`|`int`| Number of email attachments | |
84 | 81 | |`EmailAttachmentInfo`| Array<JSON Object>| Details of email attachments| |
85 | | -|`InternetMessageId`|`string` |The internet message id of the entity related to email or teams message. This field is relevant to exchange infra | |
86 | | -|`NetworkMessageId`| `guid`| The network message id of the entity related to email. This field is relevant to exchange infra | |
| 82 | +|`InternetMessageId`|`string` |Public-facing identifier for the email or Teams message that is set by the sending email system | |
| 83 | +|`NetworkMessageId`| `guid`| Unique identifier for the email, generated by Microsoft 365 | |
87 | 84 | |`EmailSubject`| `string`| Subject of the email| |
88 | | -|`ObjectId`| `string` |File full path (URL). For SharePoint and OneDrive for Business activity, the full path name of the file or folder accessed by the user. For MCAS alerts it is the alert id. For emails it is internet message id.| |
89 | | -|`ObjectName`| `string`| Name on the item on which the activity was done. In case of files it includes the extension also.| |
90 | | -|`ObjectType`| `string`| A unique enumeration value indicates type included in the activity.| |
91 | | -|`ObjectSize`| `int`| Size of the item in bytes.| |
92 | | -|`IsHidden`| `bool`| Indicates whether the user marks the content as hidden. |
93 | | -|`Id` |`guid`| Unique id of the activity log| |
94 | | -|`ActionType`|`string`| This field gives a more verbose context around the type of activity done as per the audit operation and some specific fields (in case of few specific operation). This is a comma separated list which might have multiple activity description for some particular activities like for FileCreated operation it can be "Hidden File Created" or "Sensitive File Created" or both.| |
95 | | -|`SensitiveInfoTypeInfo`| Array<JSON Object>| Information regarding the DLP sensitive information.| |
96 | | -|`SensitivtyLabelIds`|`string`| The current MIP sensitivity label ID associated with the item.| |
97 | | -|`SharepointSiteSensitivityLabelIds`|`string`| The MIP sensitivity label ID assigned to the parent site of the item related to SharePoint activities.| |
98 | | -|`PreviousSensitivityLabelId`| `string`| The old MIP sensitivity label Id for the item in case of activities where sensitive label was changed like SpoFileLabelDowngraded, SpoFileLabelRemoved, SpoSiteLabelRemoved.| |
99 | | -|`Operation`| `string`| The name of the admin activity.| |
100 | | -|`RecipientEmailAddress`| `string`| Comma separated list of recipients for the corresponding activity. It could be the recipients of email, SharePoint shared items, teams message, teams channel member addition action etc.| |
| 85 | +|`ObjectId`| `string` |Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension| |
| 86 | +|`ObjectName`| `string`| Name of the object that the recorded action was applied to, in case of files it includes the extension| |
| 87 | +|`ObjectType`| `string`| Type of object, such as a file or a folder, that the recorded action was applied to| |
| 88 | +|`ObjectSize`| `int`| Size of the object in bytes| |
| 89 | +|`IsHidden`| `bool`| Indicates whether the user has marked the content as hidden (True) or not (False) | |
| 90 | +|`ActivityId` |`guid`| Unique identifier of the activity log| |
| 91 | +|`ActionType`|`string`| Type of activity that triggered the event| |
| 92 | +|`SensitiveInfoTypeInfo`| Array<JSON Object>| Details of Data Loss Prevention sensitive info types detected in the impacted asset| |
| 93 | +|`SensitivityLabelId`|`string`|The current Microsoft Information Protection sensitivity label ID associated with the item| |
| 94 | +|`SharepointSiteSensitivityLabelIds`|`string`| The current Microsoft Information Protection sensitivity label ID assigned to the parent site of the item related to SharePoint activities | |
| 95 | +|`PreviousSensitivityLabelId`| `string`|The previous Microsoft Information Protection sensitivity label ID associated with the item in case of activities where the sensitivity label was changed| |
| 96 | +|`Operation`| `string`| Name of the admin activity| |
| 97 | +|`RecipientEmailAddress`| `string`| Email address of the recipient, or email address of the recipient after distribution list expansion| |
101 | 98 | |`SiteUrl`| `string` | xxx | |
102 | 99 | |`SourceRelativeUrl`| `string`| xxx | |
103 | | -|`TargetFilePath`| `string`| Target file path for end point activities.| |
| 100 | +|`TargetFilePath`| `string`| Target file path of endpoint activities| |
104 | 101 | |`PrinterName`| `string`| List of printers involved in the behavior| |
105 | | -|`Workload`|`string`| The Microsoft 365 service where the activity occurred.| |
106 | | -|`IrmActionCategory`| `enum`| A unique enumeration value indicating the activity category in Microsoft Purview Insider risk management.| |
107 | | -|`SequenceCorrelationId`| xx |Details of the sequence activity| |
| 102 | +|`Workload`|`string`| The Microsoft 365 service where the event occurred| |
| 103 | +|`IrmActionCategory`| `enum`| A unique enumeration value indicating the activity category in Microsoft Purview Insider Risk Management| |
| 104 | +|`SequenceCorrelationId`|`string` |Details of the sequence activity| |
108 | 105 |
|
109 | 106 |
|
110 | 107 | ## Related articles |
|
0 commit comments