Skip to content

Commit fa454dc

Browse files
samanthagysamanthagy
committed
Created six tables and added new topics
1 parent ac02dce commit fa454dc

7 files changed

+397
-0
lines changed

‎defender-xdr/TOC.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,18 @@
370370
href: advanced-hunting-deviceprocessevents-table.md
371371
- name: DeviceRegistryEvents
372372
href: advanced-hunting-deviceregistryevents-table.md
373+
- name: DeviceBaselineComplianceAssessment
374+
href: advanced-hunting-devicebaselinecomplianceassessment-table.md
375+
- name: DeviceBaselineComplianceAssessmentKB
376+
href: advanced-hunting-devicebaselinecomplianceassessmentkb-table.md
377+
- name: DeviceBaselineComplianceProfiles
378+
href: advanced-hunting-devicebaselinecomplianceprofiles-table.md
379+
- name: DeviceTvmBrowserExtensions
380+
href: advanced-hunting-devicetvmbrowserextensions-table.md
381+
- name: DeviceTvmBrowserExtensionsKB
382+
href: advanced-hunting-devicetvmbrowserextensionskb-table.md
383+
- name: DeviceTvmCertificateInfo
384+
href: advanced-hunting-devicetvmcertificateinfo-table.md
373385
- name: DeviceTvmHardwareFirmware
374386
href: advanced-hunting-devicetvmhardwarefirmware-table.md
375387
- name: DeviceTvmInfoGathering

‎defender-xdr/advanced-hunting-devicebaselinecomplianceassessment-table.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: DeviceBaselineComplianceAssessment table in the advanced hunting schema
3+
description: Learn about the baseline compliance assessment snapshot, indicating the status of various security configurations related to baseline profiles on devices in Microsoft Defender XDR.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.topic: reference
18+
ms.date: 05/30/2024
19+
---
20+
21+
# DeviceBaselineComplianceAssessment
22+
23+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
24+
25+
26+
**Applies to:**
27+
- Microsoft Defender XDR
28+
- Microsoft Defender for Endpoint
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `DeviceBaselineComplianceAssessment` table in the advanced hunting schema contains baseline compliance assessment snapshot, which indicates the status of various security configurations related to baseline profiles on devices.
34+
35+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `DeviceId` | `string` | Unique identifier for the device in the service |
40+
| `DeviceName` | `string` | Fully qualified domain name (FQDN) of the device |
41+
| `OSPlatform` | `string` | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10 and Windows 7. |
42+
| `OSVersion` | `string` | Version of the operating system running on the device |
43+
| `ConfigurationId` | `string` | Unique identifier for a specific configuration |
44+
| `ProfileId` | `string` | Unique identifier for the profile |
45+
| `IsCompliant` | `boolean` | Indicates whether the device that initiated the event is compliant or not |
46+
| `IsApplicable` | `boolean` | Indicates whether the configuration or policy is applicable |
47+
| `Source` | `dynamic` | The registry path or other location used to determine the current device setting |
48+
| `RecommendedValue` | `dynamic` | Set of expected values for the current device setting to be compliant |
49+
| `CurrentValue` | `dynamic` | Set of detected values found on the device |
50+
| `IsExempt` | `boolean` | Indicates whether the device is exempt from having the baseline configuration |
51+
| `TenantId` | `string` | |
52+
| `Type` | `string` | |
53+
| `SourceSystem` | `string` | |
54+
| `MachineGroup` | `string` | |
55+
56+
## Related topics
57+
58+
- [Proactively hunt for threats](advanced-hunting-overview.md)
59+
- [Learn the query language](advanced-hunting-query-language.md)
60+
- [Understand the schema](advanced-hunting-schema-tables.md)
61+
- [Apply query best practices](advanced-hunting-best-practices.md)
62+
- [Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
63+
64+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicebaselinecomplianceassessmentkb-table.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
title: DeviceBaselineComplianceAssessmentKB table in the advanced hunting schema
3+
description: Learn about the various security configurations used by baseline compliance to assess devices in the DeviceBaselineComplianceAssessmentKB table in the advanced hunting schema.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.topic: reference
18+
ms.date: 05/30/2024
19+
---
20+
21+
# DeviceBaselineComplianceAssessmentKB
22+
23+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
24+
25+
26+
**Applies to:**
27+
- Microsoft Defender XDR
28+
- Microsoft Defender for Endpoint
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `DeviceBaselineComplianceAssessmentKB` table in the advanced hunting schema contains information about various security configurations used by baseline compliance to assess devices.
34+
35+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `ConfigurationId` | `string` | Unique identifier for a specific configuration |
40+
| `ConfigurationName` | `string` | Display name of the configuration |
41+
| `ConfigurationDescription` | `string` | Description of the configuration |
42+
| `ConfigurationRationale` | `string` | Description of any associated risks and rationale behind the configuration |
43+
| `ConfigurationCategory` | `string` | Category or grouping to which the configuration belongs |
44+
| `BenchmarkProfileLevels` | `dynamic` | List of benchmark compliance levels for which the configuration is applicable |
45+
| `CCEReference` | `string` | Unique Common Configuration Enumeration (CCE) identifier for the configuration |
46+
| `RemediationOptions` | `string` | Recommended actions to reduce or address any associated risks |
47+
| `ConfigurationBenchmark` | `string` | Industry benchmark recommending the configuration |
48+
| `Source` | `dynamic` | The registry path or other location used to determine the current device setting |
49+
| `RecommendedValue` | `dynamic` | Set of expected values for the current device setting to be compliant |
50+
| `TenantId` | `string` | |
51+
| `Type` | `string` | |
52+
| `SourceSystem` | `string` | |
53+
54+
## Related topics
55+
56+
- [DeviceBaselineComplianceAssessment](advanced-hunting-devicebaselinecomplianceassessment-table.md)
57+
- [Understand the schema](advanced-hunting-schema-tables.md)
58+
- [Apply query best practices](advanced-hunting-best-practices.md)
59+
- [Overview of Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
60+
61+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicebaselinecomplianceprofiles-table.md‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: DeviceBaselineComplianceProfiles table in the advanced hunting schema
3+
description: Learn about the baseline profiles used for monitoring device baseline compliance in the DeviceBaselineComplianceProfiles table in the advanced hunting schema.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.topic: reference
18+
ms.date: 05/30/2024
19+
---
20+
21+
# DeviceBaselineComplianceProfiles
22+
23+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
24+
25+
26+
**Applies to:**
27+
- Microsoft Defender XDR
28+
- Microsoft Defender for Endpoint
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `DeviceBaselineComplianceProfiles` table in the advanced hunting schema contains baseline profiles used for monitoring device baseline compliance. Use this reference to construct queries that return information from the table.
34+
35+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `ProfileId` | `string` | Unique identifier for the profile |
40+
| `ProfileName` | `string` | Display name of the profile |
41+
| `ProfileDescription` | `string` | Optional description providing additional information related to the profile |
42+
| `OSPlatform` | `dynamic` | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10 and Windows 7. |
43+
| `OSVersion` | `string` | Version of the operating system running on the device |
44+
| `BaseBenchmark` | `string` | Industry benchmark on top of which the profile was created |
45+
| `BenchmarkVersion` | `string` | Version of the industry benchmark on top of which the profile was created |
46+
| `BenchmarkProfileLevel` | `string` | Benchmark compliance level set for the profile |
47+
| `Status` | `boolean` | Indicator of the profile status - can be Enabled or Disabled |
48+
| `CreatedBy` | `string` | Identity of the user account who created the profile |
49+
| `CreatedOn` | `datetime` | Date and time when the profile was created |
50+
| `LastUpdatedBy` | `string` | Identity of the user account who last updated the profile |
51+
| `LastUpdatedOn` | `datetime` | Date and time when the profile was last updated |
52+
| `TenantId` | `string` | |
53+
| `Type` | `string` | |
54+
| `SourceSystem` | `string` | |
55+
| `MachineGroup` | `string` | |
56+
57+
## Related topics
58+
59+
- [Proactively hunt for threats](advanced-hunting-overview.md)
60+
- [Understand the schema](advanced-hunting-schema-tables.md)
61+
- [Apply query best practices](advanced-hunting-best-practices.md)
62+
- [Overview Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
63+
64+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicetvmbrowserextensions-table.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: DeviceTvmBrowserExtensions table in the advanced hunting schema
3+
description: Learn about browser extension installations found on devices as shown in Microsoft Defender Vulnerability Management.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.topic: reference
18+
ms.date: 05/30/2024
19+
---
20+
21+
# DeviceTvmBrowserExtensions
22+
23+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
24+
25+
**Applies to:**
26+
- Microsoft Defender XDR
27+
- Microsoft Defender for Endpoint
28+
29+
> [!IMPORTANT]
30+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
31+
32+
Each row in the `DeviceTvmBrowserExtensions` table contains information about browser extension installations found on devices from [Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt).
33+
34+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
35+
36+
| Column name | Data type | Description |
37+
|-------------|-----------|-------------|
38+
| `DeviceId` | `string` | Unique identifier for the device in the service |
39+
| `BrowserName` | `string` | Name of the web browser with the extension |
40+
| `ExtensionId` | `string` | Unique identifier for the browser extension |
41+
| `ExtensionName` | `string` | Name of the extension |
42+
| `ExtensionDescription` | `string` | Description from the publisher about the extension |
43+
| `ExtensionVersion` | `string` | Version number of the extension |
44+
| `ExtensionRisk` | `string` | Risk level for the extension based on the permissions it has requested |
45+
| `ExtensionVendor` | `string` | Name of the vendor offering the extension |
46+
| `IsActivated` | `string` | Whether the extension is turned on or off on the devices |
47+
| `InstallationTime` | `datetime` | Date and time when the browser extension was first installed |
48+
| `TenantId` | `string` | |
49+
| `Type` | `string` | |
50+
| `SourceSystem` | `string` | |
51+
| `MachineGroup` | `string` | |
52+
53+
## Related topics
54+
55+
- [Proactively hunt for threats](advanced-hunting-overview.md)
56+
- [Learn the query language](advanced-hunting-query-language.md)
57+
- [Use shared queries](advanced-hunting-shared-queries.md)
58+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
59+
- [Understand the schema](advanced-hunting-schema-tables.md)
60+
- [Apply query best practices](advanced-hunting-best-practices.md)
61+
- [Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
62+
63+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-devicetvmbrowserextensionskb-table.md‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
---
2+
title: DeviceTvmBrowserExtensionsKB table in the advanced hunting schema
3+
description: Learn about the various browser extension details and permission information used in the Microsoft Defender Vulnerability Management browser extensions page in the DeviceTvmBrowserExtensionsKB table in the advanced hunting schema.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.topic: reference
18+
ms.date: 05/30/2024
19+
---
20+
21+
# DeviceTvmBrowserExtensionsKB
22+
23+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
24+
25+
26+
**Applies to:**
27+
- Microsoft Defender XDR
28+
- Microsoft Defender for Endpoint
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `DeviceTvmBrowserExtensionsKB` table in the advanced hunting schema contains information about browser extension details and permission information used in [Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) browser extensions page.
34+
35+
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `BrowserName` | `string` | Name of the web browser with the extension |
40+
| `ExtensionId` | `string` | Unique identifier for the browser extension |
41+
| `ExtensionName` | `string` | Name of the extension |
42+
| `ExtensionDescription` | `string` | Description from the publisher about the extension |
43+
| `ExtensionVersion` | `dynamic` | Version number of the extension |
44+
| `ExtensionRisk` | `string` | Risk level for the extension based on the permissions it has requested |
45+
| `PermissionId` | `string` | Unique identifier for the permission |
46+
| `PermissionName` | `string` | Name given to each permission based on what the extension is asking for |
47+
| `PermissionDescription` | `string` | Explanation of what the permission is supposed to do |
48+
| `PermissionRisk` | `string` | Risk level for the permission based on the type of access it would allow |
49+
| `IsPermissionRequired` | `string` | Whether the permission is required for the extension to run, or optional |
50+
| `TenantId` | `string` | |
51+
| `Type` | `string` | |
52+
| `SourceSystem` | `string` | |
53+
| `MachineGroup` | `string` | |
54+
55+
## Related topics
56+
57+
- [Proactively hunt for threats](advanced-hunting-overview.md)
58+
- [Learn the query language](advanced-hunting-query-language.md)
59+
- [Use shared queries](advanced-hunting-shared-queries.md)
60+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
61+
- [Understand the schema](advanced-hunting-schema-tables.md)
62+
- [Apply query best practices](advanced-hunting-best-practices.md)
63+
- [Overview of Microsoft Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
64+
65+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

0 commit comments

Comments
 (0)