diff --git a/windows/security/threat-protection/microsoft-defender-atp/alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md similarity index 80% rename from windows/security/threat-protection/microsoft-defender-atp/alertevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md index 37e742b7b1..b233cdf455 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/alertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -26,11 +26,9 @@ ms.date: 07/24/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -## Table description +AlertEvents is a table in the Advanced hunting schema. It contains information about alerts on Microsoft Defender Security Center. You can use the reference below to construct queries that return information from this table. -AlertEvents is a table in the Advanced hunting schema, which contains information about events on Microsoft Defender Security Center. You can use the reference below to construct queries that return information from this table. - -## Advanced hunting column reference +For information on other tables in the Advanced hunting schema, see our [Advanced hunting reference](advanced-hunting-reference.md) page. | Column name | Data type | Description | |-------------|-----------|-------------| @@ -45,7 +43,7 @@ AlertEvents is a table in the Advanced hunting schema, which contains informatio | SHA1 | string | SHA-1 of the file that the recorded action was applied to | | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | | RemoteIP | string | IP address that was being connected to | -|ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | | Table | string | Table that contains the details of the event | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md new file mode 100644 index 0000000000..5b29c9be66 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md @@ -0,0 +1,54 @@ +--- +title: MachineInfo +description: Learn about Advanced hunting table MachineInfo, such as column names, data types, and description +keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description, machineinfo +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-maave +author: martyav +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 07/24/2019 +--- + +# MachineInfo + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) + +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) + +MachineInfo is a table in the Advanced hunting schema. It contains information about machines in the organization, including OS information. You can use the reference below to construct queries that return information from this table. + +For information on other tables in the Advanced hunting schema, see our [Advanced hunting reference](advanced-hunting-reference.md) page. + +| Column name | Data type | Description | +|-------------|-----------|-------------| +| EventTime | datetime | Date and time when the event was recorded | +| MachineId | string | Unique identifier for the machine in the service | +| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| ClientVersion | string | Version of the endpoint agent or sensor running on the machine | +| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | +| OSArchitecture | string | Architecture of the operating system running on the machine | +| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | +| OSBuild | string | Build version of the operating system running on the machine | +| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | +| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | +| RegistryMachineTag | string | Machine tag added through the registry | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| OSVersion | string | Version of the operating system running on the machine | +| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | + +## Related topics + +- [All Advanced hunting tables](advanced-hunting-reference.md) +- [Advanced hunting query best practices](advanced-hunting-best-practices.md) +- [Query data using Advanced hunting](advanced-hunting.md)