mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-26 07:43:36 +00:00
resolved two content conflicts
This commit is contained in:
LauraKellerGitHub
@ -289,6 +289,16 @@ Capability Security Identifiers (SIDs) are used to uniquely and immutably identi
|
||||
|
||||
All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'. Any Capability SID added to Windows by first or third-party applications will be added to this location.
|
||||
|
||||
## Examples of registry keys taken from Windows 10, version 1909, 64-bit Enterprise edition
|
||||
You may see the following registry keys under AllCachedCapabilities:
|
||||
|
||||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock
|
||||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock_Internal
|
||||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Enterprise
|
||||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_General
|
||||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Restricted
|
||||
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Windows
|
||||
|
||||
All Capability SIDs are prefixed by S-1-15-3
|
||||
|
||||
## See also
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure S/MIME for Windows 10 and Windows 10 Mobile (Windows 10)
|
||||
description: In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them.
|
||||
description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, aka a certificate, can read them.
|
||||
ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05
|
||||
ms.reviewer:
|
||||
keywords: encrypt, digital signature
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: How Windows Defender Credential Guard works
|
||||
description: Using virtualization-based security, Windows Defender Credential Guard features a new component called the isolated LSA process, which stores and protects secrets, isolating them from the rest of the operating system, so that only privileged system software can access them.
|
||||
description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Manage Windows Defender Credential Guard (Windows 10)
|
||||
description: Deploying and managing Windows Defender Credential Guard using Group Policy, the registry, or the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool.
|
||||
description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Credential Guard Requirements (Windows 10)
|
||||
description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security associated with available hardware and firmware options.
|
||||
description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Protect derived domain credentials with Windows Defender Credential Guard (Windows 10)
|
||||
description: Introduced in Windows 10 Enterprise, Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
|
||||
description: Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
|
||||
ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
@ -35,7 +35,7 @@ By enabling Windows Defender Credential Guard, the following features and soluti
|
||||
## Related topics
|
||||
|
||||
- [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert)
|
||||
- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel)
|
||||
- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel)
|
||||
- [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert)
|
||||
- [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode)
|
||||
- [Protecting network passwords with Windows Defender Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Hello biometrics in the enterprise (Windows 10)
|
||||
description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition.
|
||||
description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition.
|
||||
ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc
|
||||
ms.reviewer:
|
||||
keywords: Windows Hello, enterprise biometrics
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Smart Card Technical Reference (Windows 10)
|
||||
description: This technical reference for the IT professional and smart card developer describes the Windows smart card infrastructure for physical smart cards and how smart card-related components work in Windows.
|
||||
description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Understanding and Evaluating Virtual Smart Cards (Windows 10)
|
||||
description: This topic for IT professional provides information about how smart card technology can fit into your authentication design, and provides links to additional topics about virtual smart cards.
|
||||
description: Learn how smart card technology can fit into your authentication design. Find links to additional topics about virtual smart cards.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN profile options (Windows 10)
|
||||
description: Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect.
|
||||
description: Windows 10 adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network.
|
||||
ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker Upgrading FAQ (Windows 10)
|
||||
description: Learn more about upgrading systems that have BitLocker enabled.
|
||||
description: Learn more about upgrading systems that have BitLocker enabled. Find frequently asked questions, such as, "Can I upgrade to Windows 10 with BitLocker enabled?"
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10)
|
||||
description: How unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) networking policies, app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
|
||||
description: Learn how unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) network policies, app configuration, and other criteria
|
||||
keywords: WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: How to collect Windows Information Protection (WIP) audit event logs (Windows 10)
|
||||
description: How to collect and understand your Windows Information Protection audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices only).
|
||||
description: How to collect & understand Windows Information Protection audit event logs via the Reporting configuration service provider (CSP) or Windows Event Forwarding.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10)
|
||||
description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list.
|
||||
description: Learn the difference between enlightened and unenlightened apps. Find out which enlightened apps are provided by Microsoft. Learn how to allow-list them.
|
||||
ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f
|
||||
ms.reviewer:
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: General guidance and best practices for Windows Information Protection (WIP) (Windows 10)
|
||||
description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP).
|
||||
description: Find resources about apps that can work with Windows Information Protection (WIP) to protect data. Enlightened apps can tell corporate and personal data apart.
|
||||
ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0
|
||||
ms.reviewer:
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection
|
||||
|
||||
@ -42,6 +42,7 @@
|
||||
#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md)
|
||||
|
||||
### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
#### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md)
|
||||
|
||||
### [Endpoint detection and response]()
|
||||
#### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md)
|
||||
@ -114,21 +115,21 @@
|
||||
#### [Advanced hunting schema reference]()
|
||||
##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md)
|
||||
##### [AlertEvents](microsoft-defender-atp/advanced-hunting-alertevents-table.md)
|
||||
##### [FileCreationEvents](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md)
|
||||
##### [ImageLoadEvents](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md)
|
||||
##### [LogonEvents](microsoft-defender-atp/advanced-hunting-logonevents-table.md)
|
||||
##### [MachineInfo](microsoft-defender-atp/advanced-hunting-machineinfo-table.md)
|
||||
##### [MachineNetworkInfo](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md)
|
||||
##### [MiscEvents](microsoft-defender-atp/advanced-hunting-miscevents-table.md)
|
||||
##### [NetworkCommunicationEvents](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md)
|
||||
##### [ProcessCreationEvents](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md)
|
||||
##### [RegistryEvents](microsoft-defender-atp/advanced-hunting-registryevents-table.md)
|
||||
##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md)
|
||||
##### [DeviceImageLoadEvents](microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md)
|
||||
##### [DeviceLogonEvents](microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md)
|
||||
##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md)
|
||||
##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md)
|
||||
##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md)
|
||||
##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md)
|
||||
##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md)
|
||||
##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md)
|
||||
##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md)
|
||||
#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md)
|
||||
#### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md)
|
||||
|
||||
|
||||
#### [Custom detections]()
|
||||
##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md)
|
||||
@ -136,8 +137,6 @@
|
||||
|
||||
### [Management and APIs]()
|
||||
#### [Overview of management and APIs](microsoft-defender-atp/management-apis.md)
|
||||
#### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md)
|
||||
#### [Managed security service provider support](microsoft-defender-atp/mssp-support.md)
|
||||
|
||||
### [Integrations]()
|
||||
#### [Microsoft Defender ATP integrations](microsoft-defender-atp/threat-protection-integration.md)
|
||||
@ -361,14 +360,15 @@
|
||||
###### [Troubleshoot subscription and portal access issues](microsoft-defender-atp/troubleshoot-onboarding-error-messages.md)
|
||||
|
||||
#### [Microsoft Defender ATP API]()
|
||||
##### [Microsoft Defender ATP API license and terms](microsoft-defender-atp/api-terms-of-use.md)
|
||||
##### [Get started with Microsoft Defender ATP APIs]()
|
||||
###### [Introduction](microsoft-defender-atp/apis-intro.md)
|
||||
###### [Microsoft Defender ATP API license and terms](microsoft-defender-atp/api-terms-of-use.md)
|
||||
###### [Access the Microsoft Defender ATP APIs](microsoft-defender-atp/apis-intro.md)
|
||||
###### [Hello World](microsoft-defender-atp/api-hello-world.md)
|
||||
###### [Get access with application context](microsoft-defender-atp/exposed-apis-create-app-webapp.md)
|
||||
###### [Get access with user context](microsoft-defender-atp/exposed-apis-create-app-nativeapp.md)
|
||||
###### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md)
|
||||
|
||||
##### [APIs]()
|
||||
##### [Microsoft Defender ATP APIs Schema]()
|
||||
###### [Supported Microsoft Defender ATP APIs](microsoft-defender-atp/exposed-apis-list.md)
|
||||
###### [Advanced Hunting](microsoft-defender-atp/run-advanced-query-api.md)
|
||||
|
||||
@ -406,7 +406,12 @@
|
||||
####### [Run antivirus scan](microsoft-defender-atp/run-av-scan.md)
|
||||
####### [Offboard machine](microsoft-defender-atp/offboard-machine-api.md)
|
||||
####### [Stop and quarantine file](microsoft-defender-atp/stop-and-quarantine-file.md)
|
||||
####### [Initiate investigation (preview)](microsoft-defender-atp/initiate-autoir-investigation.md)
|
||||
|
||||
###### [Automated Investigation]()
|
||||
####### [Investigation methods and properties](microsoft-defender-atp/investigation.md)
|
||||
####### [List Investigation](microsoft-defender-atp/get-investigation-collection.md)
|
||||
####### [Get Investigation](microsoft-defender-atp/get-investigation-object.md)
|
||||
####### [Start Investigation](microsoft-defender-atp/initiate-autoir-investigation.md)
|
||||
|
||||
###### [Indicators]()
|
||||
####### [Indicators methods and properties](microsoft-defender-atp/ti-indicator.md)
|
||||
@ -442,14 +447,14 @@
|
||||
###### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md)
|
||||
###### [Using OData Queries](microsoft-defender-atp/exposed-apis-odata-samples.md)
|
||||
|
||||
#### [Windows updates (KB) info]()
|
||||
##### [Get KbInfo collection](microsoft-defender-atp/get-kbinfo-collection.md)
|
||||
#### [Raw data streaming API]()
|
||||
##### [Raw data streaming (preview)](microsoft-defender-atp/raw-data-export.md)
|
||||
##### [Stream advanced hunting events to Azure Events hub](microsoft-defender-atp/raw-data-export-event-hub.md)
|
||||
##### [Stream advanced hunting events to your storage account](microsoft-defender-atp/raw-data-export-storage.md)
|
||||
|
||||
|
||||
#### [Common Vulnerabilities and Exposures (CVE) to KB map]()
|
||||
##### [Get CVE-KB map](microsoft-defender-atp/get-cvekbmap-collection.md)
|
||||
|
||||
|
||||
#### [Pull detections to your SIEM tools]()
|
||||
#### [SIEM integration]()
|
||||
##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md)
|
||||
##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md)
|
||||
##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md)
|
||||
@ -458,6 +463,7 @@
|
||||
##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md)
|
||||
|
||||
|
||||
#### [Reporting]()
|
||||
##### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md)
|
||||
##### [Create and build Power BI reports using Microsoft Defender ATP data connectors (deprecated)](microsoft-defender-atp/powerbi-reports.md)
|
||||
@ -484,45 +490,55 @@
|
||||
###### [Using machine groups](microsoft-defender-atp/machine-groups.md)
|
||||
###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
#### [Configure managed security service provider (MSSP) support](microsoft-defender-atp/configure-mssp-support.md)
|
||||
#### [Configure managed security service provider (MSSP) integration](microsoft-defender-atp/configure-mssp-support.md)
|
||||
|
||||
## [Partner integration scenarios]()
|
||||
### [Technical partner opportunities](microsoft-defender-atp/partner-integration.md)
|
||||
### [Managed security service provider opportunity](microsoft-defender-atp/mssp-support.md)
|
||||
### [Become a Microsoft Defender ATP partner](microsoft-defender-atp/get-started-partner-integration.md)
|
||||
|
||||
|
||||
## [Configure Microsoft threat protection integration]()
|
||||
### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md)
|
||||
### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md)
|
||||
### [Configure information protection in Windows](microsoft-defender-atp/information-protection-in-windows-config.md)
|
||||
|
||||
## [Configure portal settings]()
|
||||
### [Set up preferences](microsoft-defender-atp/preferences-setup.md)
|
||||
### [General]()
|
||||
#### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
#### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md)
|
||||
#### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md)
|
||||
#### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md)
|
||||
#### [Configure advanced features](microsoft-defender-atp/advanced-features.md)
|
||||
|
||||
### [Permissions]()
|
||||
#### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md)
|
||||
#### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
##### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
##### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md)
|
||||
###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
### [APIs]()
|
||||
#### [Enable Threat intel (Deprecated)](microsoft-defender-atp/enable-custom-ti.md)
|
||||
#### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
|
||||
### [Rules]()
|
||||
#### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md)
|
||||
#### [Manage indicators](microsoft-defender-atp/manage-indicators.md)
|
||||
#### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md)
|
||||
#### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md)
|
||||
|
||||
### [Machine management]()
|
||||
#### [Onboarding machines](microsoft-defender-atp/onboard-configure.md)
|
||||
#### [Offboarding machines](microsoft-defender-atp/offboard-machines.md)
|
||||
|
||||
### [Configure Microsoft Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md)
|
||||
|
||||
|
||||
### [Configure Microsoft threat protection integration]()
|
||||
#### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md)
|
||||
#### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md)
|
||||
#### [Configure information protection in Windows](microsoft-defender-atp/information-protection-in-windows-config.md)
|
||||
|
||||
### [Configure portal settings]()
|
||||
#### [Set up preferences](microsoft-defender-atp/preferences-setup.md)
|
||||
#### [General]()
|
||||
##### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md)
|
||||
##### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md)
|
||||
##### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md)
|
||||
##### [Configure advanced features](microsoft-defender-atp/advanced-features.md)
|
||||
|
||||
#### [Permissions]()
|
||||
##### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md)
|
||||
##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
###### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
###### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md)
|
||||
####### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
#### [APIs]()
|
||||
##### [Enable Threat intel (Deprecated)](microsoft-defender-atp/enable-custom-ti.md)
|
||||
##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
|
||||
#### [Rules]()
|
||||
##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md)
|
||||
##### [Manage indicators](microsoft-defender-atp/manage-indicators.md)
|
||||
##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md)
|
||||
##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md)
|
||||
|
||||
#### [Machine management]()
|
||||
##### [Onboarding machines](microsoft-defender-atp/onboard-configure.md)
|
||||
##### [Offboarding machines](microsoft-defender-atp/offboard-machines.md)
|
||||
|
||||
#### [Configure Microsoft Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md)
|
||||
|
||||
|
||||
## [Troubleshoot Microsoft Defender ATP]()
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Account Lockout (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit Account Lockout, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out.
|
||||
description: The policy setting, Audit Account Lockout, enables you to audit security events generated by a failed attempt to log on to an account that is locked out.
|
||||
ms.assetid: da68624b-a174-482c-9bc5-ddddab38e589
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Application Group Management (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit Application Group Management, which determines whether the operating system generates audit events when application group management tasks are performed.
|
||||
description: The policy setting, Audit Application Group Management, determines if audit events are generated when application group management tasks are performed.
|
||||
ms.assetid: 1bcaa41e-5027-4a86-96b7-f04eaf1c0606
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Authentication Policy Change (Windows 10)
|
||||
description: This topic for the IT professional describes this Advanced Security Audit policy setting, Audit Authentication Policy Change, which determines whether the operating system generates audit events when changes are made to authentication policy.
|
||||
description: The Advanced Security Audit policy setting, Audit Authentication Policy Change, determines if audit events are generated when authentication policy is changed.
|
||||
ms.assetid: aa9cea7a-aadf-47b7-b704-ac253b8e79be
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Authorization Policy Change (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Authorization Policy Change, which determines whether the operating system generates audit events when specific changes are made to the authorization policy.
|
||||
description: The policy setting, Audit Authorization Policy Change, determines if audit events are generated when specific changes are made to the authorization policy.
|
||||
ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Certification Services (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Certification Services, which determines whether the operating system generates events when Active Directory Certificate Services (ADÂ CS) operations are performed.
|
||||
description: The policy setting, Audit Certification Services, decides if events are generated when Active Directory Certificate Services (ADA CS) operations are performed.
|
||||
ms.assetid: cdefc34e-fb1f-4eff-b766-17713c5a1b03
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Computer Account Management (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit Computer Account Management, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted.
|
||||
description: The policy setting, Audit Computer Account Management, determines if audit events are generated when a computer account is created, changed, or deleted.
|
||||
ms.assetid: 6c406693-57bf-4411-bb6c-ff83ce548991
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Credential Validation (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit Credential Validation, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request.
|
||||
description: The policy setting, Audit Credential Validation, determines if audit events are generated when user account logon request credentials are submitted.
|
||||
ms.assetid: 6654b33a-922e-4a43-8223-ec5086dfc926
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Detailed Directory Service Replication (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit Detailed Directory Service Replication, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers.
|
||||
description: The Audit Detailed Directory Service Replication setting decides if audit events contain detailed tracking info about data replicated between domain controllers
|
||||
ms.assetid: 1b89c8f5-bce7-4b20-8701-42585c7ab993
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Detailed File Share (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Detailed File Share, which allows you to audit attempts to access files and folders on a shared folder.
|
||||
description: The Advanced Security Audit policy setting, Audit Detailed File Share, allows you to audit attempts to access files and folders on a shared folder.
|
||||
ms.assetid: 60310104-b820-4033-a1cb-022a34f064ae
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Directory Service Access (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Access, which determines whether the operating system generates audit events when an Active Directory Domain Services (ADÂ DS) object is accessed.
|
||||
description: The policy setting Audit Directory Service Access determines if audit events are generated when an Active Directory Domain Services (ADA DS) object is accessed.
|
||||
ms.assetid: ba2562ba-4282-4588-b87c-a3fcb771c7d0
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit DPAPI Activity (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit DPAPI Activity, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI).
|
||||
description: The policy setting, Audit DPAPI Activity, decides if encryption/decryption calls to the data protection application interface (DPAPI) generate audit events.
|
||||
ms.assetid: be4d4c83-c857-4e3d-a84e-8bcc3f2c99cd
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit File Share (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File Share, which determines whether the operating system generates audit events when a file share is accessed.
|
||||
description: The Advanced Security Audit policy setting, Audit File Share, determines if the operating system generates audit events when a file share is accessed.
|
||||
ms.assetid: 9ea985f8-8936-4b79-abdb-35cbb7138f78
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit File System (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File System, which determines whether the operating system generates audit events when users attempt to access file system objects.
|
||||
description: The Advanced Security Audit policy setting, Audit File System, determines if audit events are generated when users attempt to access file system objects.
|
||||
ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Filtering Platform Connection (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Connection, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform.
|
||||
description: The policy setting, Audit Filtering Platform Connection, decides if audit events are generated when connections are allow/blocked by Windows Filtering Platform.
|
||||
ms.assetid: d72936e9-ff01-4d18-b864-a4958815df59
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Group Membership (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit Group Membership, which enables you to audit group memberships when they are enumerated on the client PC.
|
||||
description: The advanced security audit policy setting, Audit Group Membership, enables you to audit group memberships when they are enumerated on the client PC.
|
||||
ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Handle Manipulation (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Handle Manipulation, which determines whether the operating system generates audit events when a handle to an object is opened or closed.
|
||||
description: The Advanced Security Audit policy setting, Audit Handle Manipulation, determines if audit events are generated when a handle to an object is opened or closed.
|
||||
ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit IPsec Driver (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit IPsec Driver, which determines whether the operating system generates audit events for the activities of the IPsec driver.
|
||||
description: The Advanced Security Audit policy setting, Audit IPsec Driver, determines if audit events are generated for the activities of the IPsec driver.
|
||||
ms.assetid: c8b8c02f-5ad0-4ee5-9123-ea8cdae356a5
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit IPsec Extended Mode (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Extended Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations.
|
||||
description: The setting, Audit IPsec Extended Mode, determines if audit events are generated for the results of IKE protocol and AuthIP during Extended Mode negotiations.
|
||||
ms.assetid: 2b4fee9e-482a-4181-88a8-6a79d8fc8049
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit IPsec Quick Mode (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Quick Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations.
|
||||
description: The policy setting, Audit IPsec Quick Mode, decides if audit events are generated for the results of the IKE protocol and AuthIP during Quick Mode negotiations.
|
||||
ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Kerberos Service Ticket Operations (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Service Ticket Operations, which determines whether the operating system generates security audit events for Kerberos service ticket requests.
|
||||
description: The policy setting, Audit Kerberos Service Ticket Operations, determines if security audit events are generated for Kerberos service ticket requests.
|
||||
ms.assetid: ddc0abef-ac7f-4849-b90d-66700470ccd6
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Kernel Object (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kernel Object, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores.
|
||||
description: The policy setting, Audit Kernel Object, decides if user attempts to access the system kernel (which includes mutexes and semaphores) generate audit events.
|
||||
ms.assetid: 75619d8b-b1eb-445b-afc9-0f9053be97fb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Logoff (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logoff, which determines whether the operating system generates audit events when logon sessions are terminated.
|
||||
description: The Advanced Security Audit policy setting, Audit Logoff, determines if audit events are generated when logon sessions are terminated.
|
||||
ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Logon (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logon, which determines whether the operating system generates audit events when a user attempts to log on to a computer.
|
||||
description: The Advanced Security Audit policy setting, Audit Logon, determines if audit events are generated when a user attempts to log on to a computer.
|
||||
ms.assetid: ca968d03-7d52-48c4-ba0e-2bcd2937231b
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Other Account Management Events (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Account Management Events, which determines whether the operating system generates user account management audit events.
|
||||
description: The Advanced Security Audit policy setting, Audit Other Account Management Events, determines if user account management audit events are generated.
|
||||
ms.assetid: 4ce22eeb-a96f-4cf9-a46d-6642961a31d5
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Other Logon/Logoff Events (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, which determines whether Windows generates audit events for other logon or logoff events.
|
||||
description: The Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, determines if Windows generates audit events for other logon or logoff events.
|
||||
ms.assetid: 76d987cd-1917-4907-a739-dd642609a458
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Other Object Access Events (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects.
|
||||
description: The policy setting, Audit Other Object Access Events, determines if audit events are generated for the management of Task Scheduler jobs or COM+ objects.
|
||||
ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Other Policy Change Events (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Policy Change Events, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category.
|
||||
description: The policy setting, Audit Other Policy Change Events, determines if audit events are generated for security policy changes that are not otherwise audited.
|
||||
ms.assetid: 8618502e-c21c-41cc-8a49-3dc1eb359e60
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Other System Events (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other System Events, which determines whether the operating system audits various system events.
|
||||
description: The Advanced Security Audit policy setting, Audit Other System Events, determines if the operating system audits various system events.
|
||||
ms.assetid: 2401e4cc-d94e-41ec-82a7-e10914295f8b
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit PNP Activity (Windows 10)
|
||||
description: This topic for the IT professional describes the advanced security audit policy setting, Audit PNP Activity, which determines when plug and play detects an external device.
|
||||
description: The advanced security audit policy setting, Audit PNP Activity, determines when plug and play detects an external device.
|
||||
ms.assetid: A3D87B3B-EBBE-442A-953B-9EB75A5F600E
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Security State Change (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system.
|
||||
description: The policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system.
|
||||
ms.assetid: decb3218-a67d-4efa-afc0-337c79a89a2d
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit Special Logon (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Special Logon, which determines whether the operating system generates audit events under special sign on (or log on) circumstances.
|
||||
description: The Advanced Security Audit policy setting, Audit Special Logon, determines if audit events are generated under special sign in (or logon) circumstances.
|
||||
ms.assetid: e1501bac-1d09-4593-8ebb-f311231567d3
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
@ -37,9 +37,9 @@ This subcategory allows you to audit events generated by special logons such as
|
||||
|
||||
| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments |
|
||||
|-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Domain Controller | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.<br>At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Member Server | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.<br>At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Workstation | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.<br>At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Domain Controller | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.<br>At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Member Server | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.<br>At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
| Workstation | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.<br>At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.<br>This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. |
|
||||
|
||||
**Events List:**
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit System Integrity (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit System Integrity, which determines whether the operating system audits events that violate the integrity of the security subsystem.
|
||||
description: The policy setting, Audit System Integrity, determines if the operating system audits events that violate the integrity of the security subsystem.
|
||||
ms.assetid: 942a9a7f-fa31-4067-88c7-f73978bf2034
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Audit object access (Windows 10)
|
||||
description: Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified.
|
||||
description: The policy setting, Audit object access, determines whether to audit the event generated when a user accesses an object that has its own SACL specified.
|
||||
ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -184,6 +184,7 @@ The most common values:
|
||||
| 2 | PA-ENC-TIMESTAMP | This is a normal type for standard password authentication. |
|
||||
| 11 | PA-ETYPE-INFO | The ETYPE-INFO pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value.<br>Never saw this Pre-Authentication Type in Microsoft Active Directory environment. |
|
||||
| 15 | PA-PK-AS-REP\_OLD | Used for Smart Card logon authentication. |
|
||||
| 16 | PA-PK-AS-REQ | Request sent to KDC in Smart Card authentication scenarios.|
|
||||
| 17 | PA-PK-AS-REP | This type should also be used for Smart Card authentication, but in certain Active Directory environments, it is never seen. |
|
||||
| 19 | PA-ETYPE-INFO2 | The ETYPE-INFO2 pre-authentication type is sent by the KDC in a KRB-ERROR indicating a requirement for additional pre-authentication. It is usually used to notify a client of which key to use for the encryption of an encrypted timestamp for the purposes of sending a PA-ENC-TIMESTAMP pre-authentication value.<br>Never saw this Pre-Authentication Type in Microsoft Active Directory environment. |
|
||||
| 20 | PA-SVR-REFERRAL-INFO | Used in KDC Referrals tickets. |
|
||||
|
||||
@ -126,8 +126,9 @@ This event is always logged regardless of the "Audit Policy Change" sub-category
|
||||
|
||||
- **Subcategory** \[Type = UnicodeString\]**:** the name of auditing subcategory which state was changed. Possible values:
|
||||
|
||||
| Audit Credential Validation | Audit Process Termination | Audit Other Logon/Logoff Events |
|
||||
| Value | Value | Value |
|
||||
|------------------------------------------|----------------------------------------------|--------------------------------------|
|
||||
| Audit Credential Validation | Audit Process Termination | Audit Other Logon/Logoff Events |
|
||||
| Audit Kerberos Authentication Service | Audit RPC Events | Audit Special Logon |
|
||||
| Audit Kerberos Service Ticket Operations | Audit Detailed Directory Service Replication | Audit Application Generated |
|
||||
| Audit Other Logon/Logoff Events | Audit Directory Service Access | Audit Certification Services |
|
||||
@ -145,7 +146,7 @@ This event is always logged regardless of the "Audit Policy Change" sub-category
|
||||
| Audit Policy Change | Audit Non-Sensitive Privilege Use | Audit System Integrity |
|
||||
| Audit Authentication Policy Change | Audit Sensitive Privilege Use | Audit PNP Activity |
|
||||
| Audit Authorization Policy Change | Audit Other Privilege Use Events | |
|
||||
| Group Membership | Audit Network Policy Server | |
|
||||
| Audit Group Membership | Audit Network Policy Server | |
|
||||
|
||||
- **Subcategory GUID** \[Type = GUID\]**:** the unique GUID of changed subcategory.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced. (Windows 10)
|
||||
description: Describes security event 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall. The other parts of the rule will be enforced.
|
||||
description: Security event 4952(F) Parts of a rule have been ignored because its minor version number was not recognized by Windows Firewall.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy. (Windows 10)
|
||||
description: Describes security event 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage. The service will continue enforcing the current policy.
|
||||
description: Details on security event 5027(F) The Windows Firewall Service was unable to retrieve the security policy from the local storage.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 5148(F) The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded. (Windows 10)
|
||||
description: Describes security event 5148(F) The Windows Filtering Platform has detected a DoS attack and entered a defensive mode; packets associated with this attack will be discarded.
|
||||
description: Details on Security event 5148(F), The Windows Filtering Platform has detected a DoS attack and entered a defensive mode.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: File System (Global Object Access Auditing) (Windows 10)
|
||||
description: This topic for the IT professional describes the Advanced Security Audit policy setting, File System (Global Object Access Auditing), which enables you to configure a global system access control list (SACL) on the file system for an entire computer.
|
||||
description: The policy setting, File System (Global Object Access Auditing), enables you to configure a global system access control list (SACL) for an entire computer.
|
||||
ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Monitor central access policy and rule definitions (Windows 10)
|
||||
description: This topic for the IT professional describes how to monitor changes to central access policy and central access rule definitions when you use advanced security auditing options to monitor dynamic access control objects.
|
||||
description: Learn how to use advanced security auditing options to monitor changes to central access policy and central access rule definitions.
|
||||
ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Monitor claim types (Windows 10)
|
||||
description: This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.
|
||||
description: Learn how to monitor changes to claim types that are associated with dynamic access control when you are using advanced security auditing options.
|
||||
ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Monitor resource attribute definitions (Windows 10)
|
||||
description: This topic for the IT professional describes how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.
|
||||
description: Learn how to monitor changes to resource attribute definitions when you are using advanced security auditing options to monitor dynamic access control objects.
|
||||
ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Monitor the resource attributes on files and folders (Windows 10)
|
||||
description: This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you are using advanced security auditing options to monitor dynamic access control objects.
|
||||
description: Learn how to use advanced security auditing options to monitor attempts to change settings on the resource attributes of files.
|
||||
ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Monitor the use of removable storage devices (Windows 10)
|
||||
description: This topic for the IT professional describes how to monitor attempts to use removable storage devices to access network resources. It describes how to use advanced security auditing options to monitor dynamic access control objects.
|
||||
description: Learn how advanced security auditing options can be used to monitor attempts to use removable storage devices to access network resources.
|
||||
ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Monitor user and device claims during sign-in (Windows 10)
|
||||
description: This topic for the IT professional describes how to monitor user and device claims that are associated with a user’s security token when you are using advanced security auditing options to monitor dynamic access control objects.
|
||||
description: Learn how to monitor user and device claims that are associated with a user’s security token. This advice assumes you have deployed Dynamic Access Control.
|
||||
ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Planning and deploying advanced security audit policies (Windows 10)
|
||||
description: This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies.
|
||||
description: Learn which options to consider and tasks to complete, to deploy an effective security audit policy in a network that includes advanced security audit policies.
|
||||
ms.assetid: 7428e1db-aba8-407b-a39e-509671e5a442
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Security auditing (Windows 10)
|
||||
description: Topics in this section are for IT professionals and describes the security auditing features in Windows and how your organization can benefit from using these technologies to enhance the security and manageability of your network.
|
||||
description: Learn about security auditing features in Windows, and how your organization can benefit from using them to make your network more secure and easily managed.
|
||||
ms.assetid: 2d9b8142-49bd-4a33-b246-3f0c2a5f32d4
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Using advanced security auditing options to monitor dynamic access control objects (Windows 10)
|
||||
description: This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012.
|
||||
description: Domain admins can set up advanced security audit options in Windows 10 to target specific users, or monitor potentially significant activity on multiple devices
|
||||
ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: How Microsoft identifies malware and potentially unwanted applications
|
||||
ms.reviewer:
|
||||
description: Learn how Microsoft reviews software for unwanted behavior, advertising, privacy violations, and negative consumer opinion to determine if it is malware (malicious software) or potentially unwanted applications.
|
||||
description: Learn how Microsoft reviews software for privacy violations and other negative behavior, to determine if it is malware or a potentially unwanted application.
|
||||
keywords: security, malware, virus research threats, research malware, device protection, computer infection, virus infection, descriptions, remediation, latest threats, MMdevice, Microsoft Malware Protection Center, PUA, potentially unwanted applications
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: secure
|
||||
|
||||
@ -17,9 +17,9 @@ search.appverid: met150
|
||||
---
|
||||
# Prevent malware infection
|
||||
|
||||
Malware authors are always looking for new ways to infect computers. Follow the simple tips below to stay protected and minimize threats to your data and accounts.
|
||||
Malware authors are always looking for new ways to infect computers. Follow the tips below to stay protected and minimize threats to your data and accounts.
|
||||
|
||||
## Keep software up-to-date
|
||||
## Keep software up to date
|
||||
|
||||
[Exploits](exploits-malware.md) typically use vulnerabilities in popular software such as web browsers, Java, Adobe Flash Player, and Microsoft Office to infect devices. Software updates patch vulnerabilities so they aren't available to exploits anymore.
|
||||
|
||||
@ -27,7 +27,7 @@ To keep Microsoft software up to date, ensure that [automatic Microsoft Updates]
|
||||
|
||||
## Be wary of links and attachments
|
||||
|
||||
Email and other messaging tools are a few of the most common ways your device can get infected. Attachments or links in messages can open malware directly or can stealthily trigger a download. Some emails will give instructions to allow macros or other executable content designed to make it easier for malware to infect your devices.
|
||||
Email and other messaging tools are a few of the most common ways your device can get infected. Attachments or links in messages can open malware directly or can stealthily trigger a download. Some emails give instructions to allow macros or other executable content designed to make it easier for malware to infect your devices.
|
||||
|
||||
* Use an email service that provides protection against malicious attachments, links, and abusive senders. [Microsoft Office 365](https://support.office.com/article/Anti-spam-and-anti-malware-protection-in-Office-365-5ce5cf47-2120-4e51-a403-426a13358b7e) has built-in antimalware, link protection, and spam filtering.
|
||||
|
||||
@ -35,7 +35,7 @@ For more information, see [phishing](phishing.md).
|
||||
|
||||
## Watch out for malicious or compromised websites
|
||||
|
||||
By visiting malicious or compromised sites, your device can get infected with malware automatically or you can get tricked into downloading and installing malware. See [exploits and exploit kits](exploits-malware.md) as an example of how some of these sites can automatically install malware to visiting computers.
|
||||
When you visit malicious or compromised sites, your device can get infected with malware automatically or you can get tricked into downloading and installing malware. See [exploits and exploit kits](exploits-malware.md) as an example of how some of these sites can automatically install malware to visiting computers.
|
||||
|
||||
To identify potentially harmful websites, keep the following in mind:
|
||||
|
||||
@ -43,7 +43,7 @@ To identify potentially harmful websites, keep the following in mind:
|
||||
|
||||
* Sites that aggressively open popups and display misleading buttons often trick users into accepting content through constant popups or mislabeled buttons.
|
||||
|
||||
To block malicious websites, use a modern web browser like [Microsoft Edge](https://www.microsoft.com/windows/microsoft-edge?ocid=cx-wdsi-articles) which identifies phishing and malware websites and checks downloads for malware.
|
||||
To block malicious websites, use a modern web browser like [Microsoft Edge](https://www.microsoft.com/windows/microsoft-edge?ocid=cx-wdsi-articles) that identifies phishing and malware websites and checks downloads for malware.
|
||||
|
||||
If you encounter an unsafe site, click **More […] > Send feedback** on Microsoft Edge. You can also [report unsafe sites directly to Microsoft](https://www.microsoft.com/wdsi/support/report-unsafe-site).
|
||||
|
||||
@ -53,11 +53,11 @@ Using pirated content is not only illegal, it can also expose your device to mal
|
||||
|
||||
Users do not openly discuss visits to these sites, so any untoward experience are more likely to stay unreported.
|
||||
|
||||
To stay safe, download movies, music, and apps from official publisher websites or stores. Consider running a streamlined OS such as [Windows 10 Pro SKU S Mode](https://www.microsoft.com/windows/s-mode?ocid=cx-wdsi-articles), which ensures that only vetted apps from the Windows Store are installed.
|
||||
To stay safe, download movies, music, and apps from official publisher websites or stores. Consider running a streamlined OS such as [Windows 10 Pro SKU S Mode](https://www.microsoft.com/windows/s-mode), which ensures that only vetted apps from the Windows Store are installed.
|
||||
|
||||
## Don't attach unfamiliar removable drives
|
||||
|
||||
Some types of malware can spread by copying themselves to USB flash drives or other removable drives. There are malicious individuals that intentionally prepare and distribute infected drives—leaving these drives in public places to victimize unsuspecting individuals.
|
||||
Some types of malware spread by copying themselves to USB flash drives or other removable drives. There are malicious individuals that intentionally prepare and distribute infected drives by leaving them in public places for unsuspecting individuals.
|
||||
|
||||
Only use removable drives that you are familiar with or that come from a trusted source. If a drive has been used in publicly accessible devices, like computers in a café or a library, make sure you have antimalware running on your computer before you use the drive. Avoid opening unfamiliar files you find on suspect drives, including Office and PDF documents and executable files.
|
||||
|
||||
@ -65,7 +65,7 @@ Only use removable drives that you are familiar with or that come from a trusted
|
||||
|
||||
At the time they are launched, whether inadvertently by a user or automatically, most malware run under the same privileges as the active user. This means that by limiting account privileges, you can prevent malware from making consequential changes any devices.
|
||||
|
||||
By default, Windows uses [User Account Control (UAC)](https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-overview) to provide automatic, granular control of privileges—it temporarily restricts privileges and prompts the active user every time an application attempts to make potentially consequential changes to the system. Although UAC helps limit the privileges of admin users, users can simply override this restriction when prompted. As a result, it is quite easy for an admin user to inadvertently allow malware to run.
|
||||
By default, Windows uses [User Account Control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) to provide automatic, granular control of privileges—it temporarily restricts privileges and prompts the active user every time an application attempts to make potentially consequential changes to the system. Although UAC helps limit the privileges of admin users, users can override this restriction when prompted. As a result, it is quite easy for an admin user to inadvertently allow malware to run.
|
||||
|
||||
To help ensure that everyday activities do not result in malware infection and other potentially catastrophic changes, it is recommended that you use a non-administrator account for regular use. By using a non-administrator account, you can prevent installation of unauthorized apps and prevent inadvertent changes to system settings. Avoid browsing the web or checking email using an account with administrator privileges.
|
||||
|
||||
@ -75,9 +75,9 @@ Whenever necessary, log in as an administrator to install apps or make configura
|
||||
|
||||
## Other safety tips
|
||||
|
||||
To further ensure that data is protected from malware as well as other threats:
|
||||
To further ensure that data is protected from malware and other threats:
|
||||
|
||||
* Backup files. Follow the 3-2-1 rule: make **3 copies**, store in at least **2 locations**, with at least **1 offline copy**. Use [OneDrive](https://onedrive.live.com/about/?ocid=cx-wdsi-articles) for reliable cloud-based copies that allows access to files from multiple devices and helps recover damaged or lost files, including files locked by ransomware.
|
||||
* Backup files. Follow the 3-2-1 rule: make **3 copies**, store in at least **2 locations**, with at least **1 offline copy**. Use [OneDrive](https://onedrive.live.com/about) for reliable cloud-based copies that allow access to files from multiple devices and helps recover damaged or lost files, including files locked by ransomware.
|
||||
|
||||
* Be wary when connecting to public hotspots, particularly those that do not require authentication.
|
||||
|
||||
@ -91,9 +91,9 @@ To further ensure that data is protected from malware as well as other threats:
|
||||
|
||||
Microsoft provides comprehensive security capabilities that help protect against threats. We recommend:
|
||||
|
||||
* [Automatic Microsoft updates](https://support.microsoft.com/help/12373/windows-update-faq) keeps software up-to-date to get the latest protections.
|
||||
* [Automatic Microsoft updates](https://support.microsoft.com/help/12373/windows-update-faq) keeps software up to date to get the latest protections.
|
||||
|
||||
* [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard) stops ransomware in its tracks by preventing unauthorized access to your important files. Controlled folder access locks down folders, allowing only authorized apps to access files. Unauthorized apps, including ransomware and other malicious executable files, DLLs, and scripts are denied access.
|
||||
* [Controlled folder access](../microsoft-defender-atp/enable-controlled-folders.md) stops ransomware in its tracks by preventing unauthorized access to your important files. Controlled folder access locks down folders, allowing only authorized apps to access files. Unauthorized apps, including ransomware and other malicious executable files, DLLs, and scripts are denied access.
|
||||
|
||||
* [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) browser protects against threats such as ransomware by preventing exploit kits from running. By using [Windows Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/index), Microsoft Edge blocks access to malicious websites.
|
||||
|
||||
@ -101,13 +101,13 @@ Microsoft provides comprehensive security capabilities that help protect against
|
||||
|
||||
* [Microsoft Safety Scanner](safety-scanner-download.md) helps remove malicious software from computers. NOTE: This tool does not replace your antimalware product.
|
||||
|
||||
* [Microsoft 365](https://docs.microsoft.com/microsoft-365/enterprise/#pivot=itadmin&panel=it-security) includes Office 365, Windows 10, and Enterprise Mobility + Security. These resources power productivity while providing intelligent security across users, devices, and data.
|
||||
* [Microsoft 365](https://docs.microsoft.com/microsoft-365/enterprise/) includes Office 365, Windows 10, and Enterprise Mobility + Security. These resources power productivity while providing intelligent security across users, devices, and data.
|
||||
|
||||
* [Office 365 Advanced Threat Protection](https://technet.microsoft.com/library/exchange-online-advanced-threat-protection-service-description.aspx) includes machine learning capabilities that block dangerous emails, including millions of emails carrying ransomware downloaders.
|
||||
* [Office 365 Advanced Threat Protection](https://docs.microsoft.com/office365/servicedescriptions/office-365-advanced-threat-protection-service-description) includes machine learning capabilities that block dangerous emails, including millions of emails carrying ransomware downloaders.
|
||||
|
||||
* [OneDrive for Business](https://support.office.com/article/restore-a-previous-version-of-a-file-in-onedrive-159cad6d-d76e-4981-88ef-de6e96c93893?ui=en-US&rs=en-US&ad=US) can back up files, which you would then use to restore files in the event of an infection.
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) provides comprehensive endpoint protection, detection, and response capabilities to help prevent ransomware. In the event of a breach, Microsoft Defender ATP alerts security operations teams about suspicious activities and automatically attempts to resolve the problem. This includes alerts for suspicious PowerShell commands, connecting to a TOR website, launching self-replicated copies, and deletion of volume shadow copies. Try Microsoft Defender ATP free of charge.
|
||||
* [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) provides comprehensive endpoint protection, detection, and response capabilities to help prevent ransomware. In the event of a breach, Microsoft Defender ATP alerts security operations teams about suspicious activities and automatically attempts to resolve the problem. This includes alerts for suspicious PowerShell commands, connecting to a TOR website, launching self-replicated copies, and deletion of volume shadow copies. Try Microsoft Defender ATP free of charge.
|
||||
|
||||
* [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification) replaces passwords with strong two-factor authentication on your devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN. It lets user authenticate to an Active Directory or Azure Active Directory account.
|
||||
|
||||
@ -117,6 +117,6 @@ Microsoft provides comprehensive security capabilities that help protect against
|
||||
|
||||
## What to do with a malware infection
|
||||
|
||||
Microsoft Defender ATP antivirus capabilities helps reduce the chances of infection and will automatically remove threats that it detects.
|
||||
Microsoft Defender ATP antivirus capabilities help reduce the chances of infection and will automatically remove threats that it detects.
|
||||
|
||||
In case threat removal is unsuccessful, read about [troubleshooting malware detection and removal problems](https://support.microsoft.com/help/4466982/windows-10-troubleshoot-problems-with-detecting-and-removing-malware).
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Virus Information Alliance
|
||||
ms.reviewer:
|
||||
description: The Microsoft Virus Information Alliance (VIA) is an antimalware collaboration program for security software and service providers, antimalware testing organizations, and other organizations involved in fighting cybercrime.
|
||||
description: The Microsoft Virus Information Alliance (VIA) is a collaborative antimalware program for organizations fighting cybercrime.
|
||||
keywords: security, malware, Microsoft, MMPC, Microsoft Malware Protection Center, partners, sharing, samples, vendor exchange, CSS, alliance, WDSI
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: secure
|
||||
|
||||
@ -18,10 +18,19 @@ ms.topic: article
|
||||
|
||||
# Add or Remove Machine Tags API
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
## API description
|
||||
Adds or remove tag to a specific [Machine](machine.md).
|
||||
|
||||
|
||||
## Limitations
|
||||
1. You can post on machines last seen in the past 30 days.
|
||||
2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
This API adds or remove tag to a specific machine.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
@ -77,34 +86,4 @@ Content-type: application/json
|
||||
"Action": "Add"
|
||||
}
|
||||
|
||||
```
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machine/$entity",
|
||||
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
|
||||
"computerDnsName": "mymachine1.contoso.com",
|
||||
"firstSeen": "2018-08-02T14:55:03.7791856Z",
|
||||
"lastSeen": "2018-08-02T14:55:03.7791856Z",
|
||||
"osPlatform": "Windows10",
|
||||
"osVersion": "10.0.0.0",
|
||||
"lastIpAddress": "172.17.230.209",
|
||||
"lastExternalIpAddress": "167.220.196.71",
|
||||
"agentVersion": "10.5830.18209.1001",
|
||||
"osBuild": 18209,
|
||||
"healthStatus": "Active",
|
||||
"rbacGroupId": 140,
|
||||
"rbacGroupName": "The-A-Team",
|
||||
"riskScore": "Low",
|
||||
"aadDeviceId": "80fe8ff8-2624-418e-9591-41f0491218f9",
|
||||
"machineTags": [ "test tag 1", "test tag 2" ]
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
- To remove machine tag, set the Action to 'Remove' instead of 'Add' in the request body.
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: AlertEvents table in the Advanced hunting schema
|
||||
description: Learn about alert generation events in the AlertEvents table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, alertevents, alert, severity, category
|
||||
title: AlertEvents table in the advanced hunting schema
|
||||
description: Learn about alert generation events in the AlertEvents table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, alertevents, alert, severity, category
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -26,25 +26,25 @@ ms.date: 10/08/2019
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The AlertEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table.
|
||||
The `AlertEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| AlertId | string | Unique identifier for the alert |
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert |
|
||||
| Category | string | Type of threat indicator or breach activity identified by the alert |
|
||||
| Title | string | Title of the alert |
|
||||
| FileName | string | Name of the file that the recorded action was applied to |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| RemoteIP | string | IP address that was being connected to |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| Table | string | Table that contains the details of the event |
|
||||
| `AlertId` | string | Unique identifier for the alert |
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `Severity` | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert |
|
||||
| `Category` | string | Type of threat indicator or breach activity identified by the alert |
|
||||
| `Title` | string | Title of the alert |
|
||||
| `FileName` | string | Name of the file that the recorded action was applied to |
|
||||
| `SHA1` | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| `RemoteIP` | string | IP address that was being connected to |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `Table` | string | Table that contains the details of the event |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Query best practices for Advanced hunting
|
||||
description: Learn how to construct fast, efficient, and error-free threat hunting queries when using Advanced hunting
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto, avoid timeout, command lines, process id
|
||||
title: Query best practices for advanced hunting
|
||||
description: Learn how to construct fast, efficient, and error-free threat hunting queries when using advanced hunting
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, avoid timeout, command lines, process id
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -41,14 +41,14 @@ Apply these recommendations to get results faster and avoid timeouts while runni
|
||||
## Query tips and pitfalls
|
||||
|
||||
### Queries with process IDs
|
||||
Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `MachineId` or `ComputerName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`).
|
||||
Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `DeviceId` or `DeviceName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`).
|
||||
|
||||
The following example query finds processes that access more than 10 IP addresses over port 445 (SMB), possibly scanning for file shares.
|
||||
|
||||
```
|
||||
NetworkCommunicationEvents
|
||||
| where RemotePort == 445 and EventTime > ago(12h) and InitiatingProcessId !in (0, 4)
|
||||
| summarize RemoteIPCount=dcount(RemoteIP) by ComputerName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessFileName
|
||||
```kusto
|
||||
DeviceNetworkEvents
|
||||
| where RemotePort == 445 and Timestamp > ago(12h) and InitiatingProcessId !in (0, 4)
|
||||
| summarize RemoteIPCount=dcount(RemoteIP) by DeviceName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessFileName
|
||||
| where RemoteIPCount > 10
|
||||
```
|
||||
|
||||
@ -68,19 +68,19 @@ To create more durable queries using command lines, apply the following practice
|
||||
|
||||
The following examples show various ways to construct a query that looks for the file *net.exe* to stop the Windows Defender Firewall service:
|
||||
|
||||
```
|
||||
```kusto
|
||||
// Non-durable query - do not use
|
||||
ProcessCreationEvents
|
||||
DeviceProcessEvents
|
||||
| where ProcessCommandLine == "net stop MpsSvc"
|
||||
| limit 10
|
||||
|
||||
// Better query - filters on filename, does case-insensitive matches
|
||||
ProcessCreationEvents
|
||||
| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc"
|
||||
DeviceProcessEvents
|
||||
| where Timestamp > ago(7d) and FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc"
|
||||
|
||||
// Best query also ignores quotes
|
||||
ProcessCreationEvents
|
||||
| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe")
|
||||
DeviceProcessEvents
|
||||
| where Timestamp > ago(7d) and FileName in~ ("net.exe", "net1.exe")
|
||||
| extend CanonicalCommandLine=replace("\"", "", ProcessCommandLine)
|
||||
| where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc"
|
||||
```
|
||||
|
||||
@ -0,0 +1,86 @@
|
||||
---
|
||||
title: DeviceEvents table in the advanced hunting schema
|
||||
description: Learn about antivirus, firewall, and other event types in the miscellaneous device events (DeviceEvents) table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard, MiscEvents
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The miscellaneous device events or `DeviceEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ActionType` | string | Type of activity that triggered the event |
|
||||
| `FileName` | string | Name of the file that the recorded action was applied to |
|
||||
| `FolderPath` | string | Folder containing the file that the recorded action was applied to |
|
||||
| `SHA1` | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available |
|
||||
| `MD5` | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| `AccountDomain` | string | Domain of the account |
|
||||
| `AccountName` |string | User name of the account |
|
||||
| `AccountSid` | string | Security Identifier (SID) of the account |
|
||||
| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information |
|
||||
| `ProcessId` | int | Process ID (PID) of the newly created process |
|
||||
| `ProcessCommandLine` | string | Command line used to create the new process |
|
||||
| `ProcessCreationTime` | datetime | Date and time the process was created |
|
||||
| `ProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process |
|
||||
| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts |
|
||||
| `RegistryKey` | string | Registry key that the recorded action was applied to |
|
||||
| `RegistryValueName` | string | Name of the registry value that the recorded action was applied to |
|
||||
| `RegistryValueData` | string | Data of the registry value that the recorded action was applied to |
|
||||
| `RemoteIP` | string | IP address that was being connected to |
|
||||
| `RemotePort` | int | TCP port on the remote device that was being connected to |
|
||||
| `LocalIP` | string | IP address assigned to the local machine used during communication |
|
||||
| `LocalPort` | int | TCP port on the local machine used during communication |
|
||||
| `FileOriginUrl` | string | URL where the file was downloaded from |
|
||||
| `FileOriginIP` | string | IP address where the file was downloaded from |
|
||||
| `AdditionalFields` | string | Additional information about the event in JSON array format |
|
||||
| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available |
|
||||
| `InitiatingProcessFileName` | string | Name of the process that initiated the event |
|
||||
| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event |
|
||||
| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event |
|
||||
| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event |
|
||||
| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started |
|
||||
| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,78 @@
|
||||
---
|
||||
title: DeviceFileEvents table in the advanced hunting schema
|
||||
description: Learn about file-related events in the DeviceFileEvents table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5, FileCreationEvents
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceFileEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceFileEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ActionType` | string | Type of activity that triggered the event |
|
||||
| `FileName` | string | Name of the file that the recorded action was applied to |
|
||||
| `FolderPath` | string | Folder containing the file that the recorded action was applied to |
|
||||
| `SHA1` | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available |
|
||||
| `MD5` | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| `FileOriginUrl` | string | URL where the file was downloaded from |
|
||||
| `FileOriginReferrerUrl` | string | URL of the web page that links to the downloaded file |
|
||||
| `FileOriginIP` | string | IP address where the file was downloaded from |
|
||||
| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event |
|
||||
| `InitiatingProcessFileName` | string | Name of the process that initiated the event |
|
||||
| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event |
|
||||
| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event |
|
||||
| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started |
|
||||
| `InitiatingProcessIntegrityLevel` | string | integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| `RequestProtocol` | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS |
|
||||
| `ShareName` | string | Name of shared folder containing the file |
|
||||
| `RequestSourceIP` | string | IPv4 or IPv6 address of the remote device that initiated the activity |
|
||||
| `RequestSourcePort` | string | Source port on the remote device that initiated the activity |
|
||||
| `RequestAccountName` | string | User name of account used to remotely initiate the activity |
|
||||
| `RequestAccountDomain` | string | Domain of the account used to remotely initiate the activity |
|
||||
| `RequestAccountSid` | string | Security Identifier (SID) of the account to remotely initiate the activity |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns |
|
||||
| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
| `SensitivityLabel` | string | Label applied to an email, file, or other content to classify it for information protection |
|
||||
| `SensitivitySubLabel` | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently |
|
||||
| `IsAzureInfoProtectionApplied` | boolean | Indicates whether the file is encrypted by Azure Information Protection |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,64 @@
|
||||
---
|
||||
title: DeviceImageLoadEvents table in the advanced hunting schema
|
||||
description: Learn about DLL loading events in the DeviceImageLoadEvents table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image, ImageLoadEvents
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceImageLoadEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceImageLoadEvents table` in the [advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ActionType` | string | Type of activity that triggered the event |
|
||||
| `FileName` | string | Name of the file that the recorded action was applied to |
|
||||
| `FolderPath` | string | Folder containing the file that the recorded action was applied to |
|
||||
| `SHA1` | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| `MD5` | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessFileName` | string | Name of the process that initiated the event |
|
||||
| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event |
|
||||
| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event |
|
||||
| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started |
|
||||
| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event |
|
||||
| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,53 @@
|
||||
---
|
||||
title: DeviceInfo table in the advanced hunting schema
|
||||
description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users, MachineInfo
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceInfo
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ClientVersion` | string | Version of the endpoint agent or sensor running on the machine |
|
||||
| `PublicIP` | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy |
|
||||
| `OSArchitecture` | string | Architecture of the operating system running on the machine |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 |
|
||||
| `OSBuild` | string | Build version of the operating system running on the machine |
|
||||
| `IsAzureADJoined` | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory |
|
||||
| `LoggedOnUsers` | string | List of all users that are logged on the machine at the time of the event in JSON array format |
|
||||
| `RegistryDeviceTag` | string | Machine tag added through the registry |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns |
|
||||
| `OSVersion` | string | Version of the operating system running on the machine |
|
||||
| `MachineGroup` | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: DeviceLogonEvents table in the advanced hunting schema
|
||||
description: Learn about authentication or sign-in events in the DeviceLogonEvents table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in, LogonEvents
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceLogonEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceLogonEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ActionType` | string |Type of activity that triggered the event |
|
||||
| `AccountDomain` | string | Domain of the account |
|
||||
| `AccountName` | string | User name of the account |
|
||||
| `AccountSid` | string | Security Identifier (SID) of the account |
|
||||
| `LogonType` | string | Type of logon session, specifically:<br><br> - **Interactive** - User physically interacts with the machine using the local keyboard and screen<br><br> - **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients<br><br> - **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed<br><br> - **Batch** - Session initiated by scheduled tasks<br><br> - **Service** - Session initiated by services as they start<br> |
|
||||
| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts |
|
||||
| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information |
|
||||
| `RemoteIP` | string | IP address that was being connected to |
|
||||
| `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast |
|
||||
| `RemotePort` | int | TCP port on the remote device that was being connected to |
|
||||
| `AdditionalFields` | string | Additional information about the event in JSON array format |
|
||||
| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available |
|
||||
| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessFileName` | string | Name of the process that initiated the event |
|
||||
| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event |
|
||||
| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event |
|
||||
| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started |
|
||||
| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event |
|
||||
| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
| `IsLocalAdmin` | boolean | Boolean indicator of whether the user is a local administrator on the machine |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
title: DeviceNetworkEvents table in the advanced hunting schema
|
||||
description: Learn about network connection events you can query from the DeviceNetworkEvents table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip, NetworkCommunicationEvents
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceNetworkEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceNetworkEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ActionType` | string | Type of activity that triggered the event |
|
||||
| `RemoteIP` | string | IP address that was being connected to |
|
||||
| `RemotePort` | int | TCP port on the remote device that was being connected to |
|
||||
| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| `LocalIP` | string | IP address assigned to the local machine used during communication |
|
||||
| `LocalPort` | int | TCP port on the local machine used during communication |
|
||||
| `Protocol` | string | IP protocol used, whether TCP or UDP |
|
||||
| `LocalIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast |
|
||||
| `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast |
|
||||
| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessFileName` | string | Name of the process that initiated the event |
|
||||
| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event |
|
||||
| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event |
|
||||
| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started |
|
||||
| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event |
|
||||
| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,54 @@
|
||||
---
|
||||
title: DeviceNetworkInfo table in the advanced hunting schema
|
||||
description: Learn about network configuration information in the DeviceNetworkInfo table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel, MachineNetworkInfo
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceNetworkInfo
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceNetworkInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `NetworkAdapterName` | string | Name of the network adapter |
|
||||
| `MacAddress` | string | MAC address of the network adapter |
|
||||
| `NetworkAdapterType` | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) |
|
||||
| `NetworkAdapterStatus` | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) |
|
||||
| `TunnelType` | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH |
|
||||
| `ConnectedNetworks` | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet |
|
||||
| `DnsAddresses` | string | DNS server addresses in JSON array format |
|
||||
| `IPv4Dhcp` | string | IPv4 address of DHCP server |
|
||||
| `IPv6Dhcp` | string | IPv6 address of DHCP server |
|
||||
| `DefaultGateways` | string | Default gateway addresses in JSON array format |
|
||||
| `IPAddresses` | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
title: DeviceProcessEvents table in the advanced hunting schema
|
||||
description: Learn about the process spawning or creation events in the DeviceProcessEvents table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line, ProcessCreationEvents
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceProcessEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceProcessEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ActionType` | string | Type of activity that triggered the event |
|
||||
| `FileName` | string | Name of the file that the recorded action was applied to |
|
||||
| `FolderPath` | string | Folder containing the file that the recorded action was applied to |
|
||||
| `SHA1` | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. |
|
||||
| `MD5` | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| `ProcessId` | int | Process ID (PID) of the newly created process |
|
||||
| `ProcessCommandLine` | string | Command line used to create the new process |
|
||||
| `ProcessIntegrityLevel` | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources |
|
||||
| `ProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process |
|
||||
| `ProcessCreationTime` | datetime | Date and time the process was created |
|
||||
| `AccountDomain` | string | Domain of the account |
|
||||
| `AccountName` | string | User name of the account |
|
||||
| `AccountSid` | string | Security Identifier (SID) of the account |
|
||||
| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts |
|
||||
| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. |
|
||||
| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available |
|
||||
| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessFileName` | string | Name of the process that initiated the event |
|
||||
| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event |
|
||||
| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event |
|
||||
| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started |
|
||||
| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event |
|
||||
| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -0,0 +1,66 @@
|
||||
---
|
||||
title: DeviceRegistryEvents table in the advanced hunting schema
|
||||
description: Learn about registry events you can query from the DeviceRegistryEvents table of the advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value, RegistryEvents
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# DeviceRegistryEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The `DeviceRegistryEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `Timestamp` | datetime | Date and time when the event was recorded |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `ActionType` | string | Type of activity that triggered the event |
|
||||
| `RegistryKey` | string | Registry key that the recorded action was applied to |
|
||||
| `RegistryValueType` | string | Data type, such as binary or string, of the registry value that the recorded action was applied to |
|
||||
| `RegistryValueName` | string | Name of the registry value that the recorded action was applied to |
|
||||
| `RegistryValueData` | string | Data of the registry value that the recorded action was applied to |
|
||||
| `PreviousRegistryValueName` | string | Original name of the registry value before it was modified |
|
||||
| `PreviousRegistryValueData` | string | Original data of the registry value before it was modified |
|
||||
| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| `InitiatingProcessFileName` | string | Name of the process that initiated the event |
|
||||
| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event |
|
||||
| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event |
|
||||
| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started |
|
||||
| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event |
|
||||
| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,78 +0,0 @@
|
||||
---
|
||||
title: FileCreationEvents table in the Advanced hunting schema
|
||||
description: Learn about file-related events in the FileCreationEvents table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, filecreationevents, files, path, hash, sha1, sha256, md5
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# FileCreationEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The FileCreationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ActionType | string | Type of activity that triggered the event |
|
||||
| FileName | string | Name of the file that the recorded action was applied to |
|
||||
| FolderPath | string | Folder containing the file that the recorded action was applied to |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available |
|
||||
| MD5 | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| FileOriginUrl | string | URL where the file was downloaded from |
|
||||
| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file |
|
||||
| FileOriginIP | string | IP address where the file was downloaded from |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| RequestProtocol | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS |
|
||||
| ShareName | string | Name of shared folder containing the file |
|
||||
| RequestSourceIP | string | IPv4 or IPv6 address of the remote device that initiated the activity |
|
||||
| RequestSourcePort | string | Source port on the remote device that initiated the activity |
|
||||
| RequestAccountName | string | User name of account used to remotely initiate the activity |
|
||||
| RequestAccountDomain | string | Domain of the account used to remotely initiate the activity |
|
||||
| RequestAccountSid | string | Security Identifier (SID) of the account to remotely initiate the activity |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
| SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection |
|
||||
| SensitivitySubLabel | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently |
|
||||
| IsAzureInfoProtectionApplied | boolean | Indicates whether the file is encrypted by Azure Information Protection |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,64 +0,0 @@
|
||||
---
|
||||
title: ImageLoadEvents table in the Advanced hunting schema
|
||||
description: Learn about DLL loading events in the ImageLoadEvents table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, imageloadevents, DLL loading, library, file image
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# ImageLoadEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The ImageLoadEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ActionType | string | Type of activity that triggered the event |
|
||||
| FileName | string | Name of the file that the recorded action was applied to |
|
||||
| FolderPath | string | Folder containing the file that the recorded action was applied to |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| MD5 | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,72 +0,0 @@
|
||||
---
|
||||
title: LogonEvents table in the Advanced hunting schema
|
||||
description: Learn about authentication or sign-in events in the LogonEvents table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, logonevents, authentication, logon, sign in
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# LogonEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The LogonEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ActionType | string |Type of activity that triggered the event |
|
||||
| AccountDomain | string | Domain of the account |
|
||||
| AccountName | string | User name of the account |
|
||||
| AccountSid | string | Security Identifier (SID) of the account |
|
||||
| LogonType | string | Type of logon session, specifically:<br><br> - **Interactive** - User physically interacts with the machine using the local keyboard and screen<br><br> - **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients<br><br> - **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed<br><br> - **Batch** - Session initiated by scheduled tasks<br><br> - **Service** - Session initiated by services as they start<br> |
|
||||
| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts |
|
||||
| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information |
|
||||
| RemoteIP | string | IP address that was being connected to |
|
||||
| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast |
|
||||
| RemotePort | int | TCP port on the remote device that was being connected to |
|
||||
| AdditionalFields | string | Additional information about the event in JSON array format |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available |
|
||||
| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
| IsLocalAdmin | boolean | Boolean indicator of whether the user is a local administrator on the machine |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,53 +0,0 @@
|
||||
---
|
||||
title: MachineInfo table in the Advanced hunting schema
|
||||
description: Learn about OS, computer name, and other machine information in the MachineInfo table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, machineinfo, device, machine, OS, platform, users
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# MachineInfo
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The MachineInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ClientVersion | string | Version of the endpoint agent or sensor running on the machine |
|
||||
| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy |
|
||||
| OSArchitecture | string | Architecture of the operating system running on the machine |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 |
|
||||
| OSBuild | string | Build version of the operating system running on the machine |
|
||||
| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory |
|
||||
| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format |
|
||||
| RegistryMachineTag | string | Machine tag added through the registry |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| OSVersion | string | Version of the operating system running on the machine |
|
||||
| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,54 +0,0 @@
|
||||
---
|
||||
title: MachineNetworkInfo table in the Advanced hunting schema
|
||||
description: Learn about network configuration information in the MachineNetworkInfo table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, machinenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# MachineNetworkInfo
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The MachineNetworkInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| NetworkAdapterName | string | Name of the network adapter |
|
||||
| MacAddress | string | MAC address of the network adapter |
|
||||
| NetworkAdapterType | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) |
|
||||
| NetworkAdapterStatus | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) |
|
||||
| TunnelType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH |
|
||||
| ConnectedNetworks | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet |
|
||||
| DnsAddresses | string | DNS server addresses in JSON array format |
|
||||
| IPv4Dhcp | string | IPv4 address of DHCP server |
|
||||
| IPv6Dhcp | string | IPv6 address of DHCP server |
|
||||
| DefaultGateways | string | Default gateway addresses in JSON array format |
|
||||
| IPAddresses | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,85 +0,0 @@
|
||||
---
|
||||
title: MiscEvents table in the advanced hunting schema
|
||||
description: Learn about antivirus, firewall, and other event types in the miscellaneous events (MiscEvents) table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# MiscEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The miscellaneous events or MiscEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ActionType | string | Type of activity that triggered the event |
|
||||
| FileName | string | Name of the file that the recorded action was applied to |
|
||||
| FolderPath | string | Folder containing the file that the recorded action was applied to |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available |
|
||||
| MD5 | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| AccountDomain | string | Domain of the account |
|
||||
| AccountName |string | User name of the account |
|
||||
| AccountSid | string | Security Identifier (SID) of the account |
|
||||
| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information |
|
||||
| ProcessId | int | Process ID (PID) of the newly created process |
|
||||
| ProcessCommandLine | string | Command line used to create the new process |
|
||||
| ProcessCreationTime | datetime | Date and time the process was created |
|
||||
| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process |
|
||||
| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts |
|
||||
| RegistryKey | string | Registry key that the recorded action was applied to |
|
||||
| RegistryValueName | string | Name of the registry value that the recorded action was applied to |
|
||||
| RegistryValueData | string | Data of the registry value that the recorded action was applied to |
|
||||
| RemoteIP | string | IP address that was being connected to |
|
||||
| RemotePort | int | TCP port on the remote device that was being connected to |
|
||||
| LocalIP | string | IP address assigned to the local machine used during communication |
|
||||
| LocalPort | int | TCP port on the local machine used during communication |
|
||||
| FileOriginUrl | string | URL where the file was downloaded from |
|
||||
| FileOriginIP | string | IP address where the file was downloaded from |
|
||||
| AdditionalFields | string | Additional information about the event in JSON array format |
|
||||
| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,68 +0,0 @@
|
||||
---
|
||||
title: NetworkCommunicationEvents table in the Advanced hunting schema
|
||||
description: Learn about network connection events you can query from the NetworkCommunicationEvents table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, networkcommunicationevents, network connection, remote ip, local ip
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# NetworkCommunicationEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The NetworkCommunicationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ActionType | string | Type of activity that triggered the event |
|
||||
| RemoteIP | string | IP address that was being connected to |
|
||||
| RemotePort | int | TCP port on the remote device that was being connected to |
|
||||
| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| LocalIP | string | IP address assigned to the local machine used during communication |
|
||||
| LocalPort | int | TCP port on the local machine used during communication |
|
||||
| Protocol | string | IP protocol used, whether TCP or UDP |
|
||||
| LocalIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast |
|
||||
| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast |
|
||||
| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Overview of Advanced hunting
|
||||
title: Overview of advanced hunting
|
||||
description: Use threat hunting capabilities in Microsoft Defender ATP to build queries that find threats and weaknesses in your network
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# Proactively hunt for threats with Advanced hunting
|
||||
# Proactively hunt for threats with advanced hunting
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -28,9 +28,9 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t
|
||||
|
||||
You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines.
|
||||
|
||||
## Get started with Advanced hunting
|
||||
## Get started with advanced hunting
|
||||
|
||||
We recommend going through several steps to quickly get up and running with Advanced hunting.
|
||||
We recommend going through several steps to quickly get up and running with advanced hunting.
|
||||
|
||||
| Learning goal | Description | Resource |
|
||||
|--|--|--|
|
||||
@ -41,7 +41,7 @@ We recommend going through several steps to quickly get up and running with Adva
|
||||
|
||||
## Get help as you write queries
|
||||
Take advantage of the following functionality to write queries faster:
|
||||
- **Autosuggest** — as you write queries, Advanced hunting provides suggestions.
|
||||
- **Autosuggest** — as you write queries, advanced hunting provides suggestions.
|
||||
- **Schema reference** — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor.
|
||||
|
||||
## Drilldown from query results
|
||||
@ -54,14 +54,14 @@ Right-click a value in the result set to quickly enhance your query. You can use
|
||||
- Exclude the selected value from the query (`!=`)
|
||||
- Get more advanced operators for adding the value to your query, such as `contains`, `starts with` and `ends with`
|
||||
|
||||
|
||||
|
||||
|
||||
## Filter the query results
|
||||
The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances.
|
||||
|
||||
Refine your query by selecting the "+" or "-" buttons next to the values that you want to include or exclude.
|
||||
|
||||
|
||||
|
||||
|
||||
Once you apply the filter to modify the query and then run the query, the results are updated accordingly.
|
||||
|
||||
|
||||
@ -1,76 +0,0 @@
|
||||
---
|
||||
title: ProcessCreationEvents table in the Advanced hunting schema
|
||||
description: Learn about the process spawning or creation events in the ProcessCreationEvents table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, processcreationevents, process id, command line
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# ProcessCreationEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The ProcessCreationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ActionType | string | Type of activity that triggered the event |
|
||||
| FileName | string | Name of the file that the recorded action was applied to |
|
||||
| FolderPath | string | Folder containing the file that the recorded action was applied to |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. |
|
||||
| MD5 | string | MD5 hash of the file that the recorded action was applied to |
|
||||
| ProcessId | int | Process ID (PID) of the newly created process |
|
||||
| ProcessCommandLine | string | Command line used to create the new process |
|
||||
| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources |
|
||||
| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process |
|
||||
| ProcessCreationTime | datetime | Date and time the process was created |
|
||||
| AccountDomain | string | Domain of the account |
|
||||
| AccountName | string | User name of the account |
|
||||
| AccountSid | string | Security Identifier (SID) of the account |
|
||||
| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available |
|
||||
| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Learn the Advanced hunting query language
|
||||
description: Create your first threat hunting query and learn about common operators and other aspects of the Advanced hunting query language
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, language, learn, first query, telemetry, events, telemetry, custom detections, schema, kusto, operators, data types
|
||||
title: Learn the advanced hunting query language
|
||||
description: Create your first threat hunting query and learn about common operators and other aspects of the advanced hunting query language
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, language, learn, first query, telemetry, events, telemetry, custom detections, schema, kusto, operators, data types
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -18,14 +18,15 @@ ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# Learn the Advanced hunting query language
|
||||
# Learn the advanced hunting query language
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for Advanced hunting. To understand these concepts better, run your first query.
|
||||
Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for advanced hunting. To understand these concepts better, run your first query.
|
||||
|
||||
## Try your first query
|
||||
|
||||
@ -33,37 +34,37 @@ In Microsoft Defender Security Center, go to **Advanced hunting** to run your fi
|
||||
|
||||
```kusto
|
||||
// Finds PowerShell execution events that could involve a download.
|
||||
ProcessCreationEvents
|
||||
| where EventTime > ago(7d)
|
||||
DeviceProcessEvents
|
||||
| where Timestamp > ago(7d)
|
||||
| where FileName in ("powershell.exe", "POWERSHELL.EXE", "powershell_ise.exe", "POWERSHELL_ISE.EXE")
|
||||
| where ProcessCommandLine has "Net.WebClient"
|
||||
or ProcessCommandLine has "DownloadFile"
|
||||
or ProcessCommandLine has "Invoke-WebRequest"
|
||||
or ProcessCommandLine has "Invoke-Shellcode"
|
||||
or ProcessCommandLine contains "http:"
|
||||
| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine
|
||||
| top 100 by EventTime
|
||||
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
|
||||
| top 100 by Timestamp
|
||||
```
|
||||
|
||||
This is how it will look like in Advanced hunting.
|
||||
This is how it will look like in advanced hunting.
|
||||
|
||||
|
||||
|
||||
|
||||
### Describe the query and specify the table to search
|
||||
The query starts with a short comment describing what it is for. This helps if you later decide to save your query and share it with others in your organization.
|
||||
|
||||
```kusto
|
||||
// Finds PowerShell execution events that could involve a download.
|
||||
ProcessCreationEvents
|
||||
DeviceProcessEvents
|
||||
```
|
||||
|
||||
The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by adding with the table name `ProcessCreationEvents` and add piped elements as needed.
|
||||
The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by adding with the table name `DeviceProcessEvents` and add piped elements as needed.
|
||||
|
||||
### Set the time range
|
||||
The first piped element is a time filter scoped within the previous seven days. Keeping the time range as narrow as possible ensures that queries perform well, return manageable results, and don't time out.
|
||||
|
||||
```kusto
|
||||
| where EventTime > ago(7d)
|
||||
| where Timestamp > ago(7d)
|
||||
```
|
||||
### Search for specific executable files
|
||||
The time range is immediately followed by a search for files representing the PowerShell application.
|
||||
@ -85,48 +86,48 @@ Afterwards, the query looks for command lines that are typically used with Power
|
||||
Now that your query clearly identifies the data you want to locate, you can add elements that define what the results look like. `project` returns specific columns and `top` limits the number of results, making the results well-formatted and reasonably large and easy to process.
|
||||
|
||||
```kusto
|
||||
| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine
|
||||
| top 100 by EventTime
|
||||
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
|
||||
| top 100 by Timestamp
|
||||
```
|
||||
|
||||
Click **Run query** to see the results. You can expand the screen view so you can focus on your hunting query and the results.
|
||||
|
||||
## Learn common query operators for Advanced hunting
|
||||
## Learn common query operators for advanced hunting
|
||||
|
||||
Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by Advanced hunting supports a range of operators, including the following common ones.
|
||||
Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by advanced hunting supports a range of operators, including the following common ones.
|
||||
|
||||
| Operator | Description and usage |
|
||||
|--|--|
|
||||
| **`where`** | Filter a table to the subset of rows that satisfy a predicate. |
|
||||
| **`summarize`** | Produce a table that aggregates the content of the input table. |
|
||||
| **`join`** | Merge the rows of two tables to form a new table by matching values of the specified column(s) from each table. |
|
||||
| **`count`** | Return the number of records in the input record set. |
|
||||
| **`top`** | Return the first N records sorted by the specified columns. |
|
||||
| **`limit`** | Return up to the specified number of rows. |
|
||||
| **`project`** | Select the columns to include, rename or drop, and insert new computed columns. |
|
||||
| **`extend`** | Create calculated columns and append them to the result set. |
|
||||
| **`makeset`** | Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group. |
|
||||
| **`find`** | Find rows that match a predicate across a set of tables. |
|
||||
| `where` | Filter a table to the subset of rows that satisfy a predicate. |
|
||||
| `summarize` | Produce a table that aggregates the content of the input table. |
|
||||
| `join` | Merge the rows of two tables to form a new table by matching values of the specified column(s) from each table. |
|
||||
| `count` | Return the number of records in the input record set. |
|
||||
| `top` | Return the first N records sorted by the specified columns. |
|
||||
| `limit` | Return up to the specified number of rows. |
|
||||
| `project` | Select the columns to include, rename or drop, and insert new computed columns. |
|
||||
| `extend` | Create calculated columns and append them to the result set. |
|
||||
| `makeset` | Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group. |
|
||||
| `find` | Find rows that match a predicate across a set of tables. |
|
||||
|
||||
To see a live example of these operators, run them from the **Get started** section of the Advanced hunting page.
|
||||
To see a live example of these operators, run them from the **Get started** section of the advanced hunting page.
|
||||
|
||||
## Understand data types
|
||||
|
||||
Data in Advanced hunting tables are generally classified into the following data types.
|
||||
Data in advanced hunting tables are generally classified into the following data types.
|
||||
|
||||
| Data type | Description and query implications |
|
||||
|--|--|
|
||||
| **datetime** | Data and time information typically representing event timestamps |
|
||||
| **string** | Character string |
|
||||
| **bool** | True or false |
|
||||
| **int** | 32-bit numeric value |
|
||||
| **long** | 64-bit numeric value |
|
||||
| `datetime` | Data and time information typically representing event timestamps |
|
||||
| `string` | Character string |
|
||||
| `bool` | True or false |
|
||||
| `int` | 32-bit numeric value |
|
||||
| `long` | 64-bit numeric value |
|
||||
|
||||
## Use sample queries
|
||||
|
||||
The **Get started** section provides a few simple queries using commonly used operators. Try running these queries and making small modifications to them.
|
||||
|
||||
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the GitHub query repository.
|
||||
@ -140,4 +141,5 @@ For detailed information about the query language, see [Kusto query language doc
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Apply query best practices](advanced-hunting-best-practices.md)
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
|
||||
|
||||
@ -1,66 +0,0 @@
|
||||
---
|
||||
title: RegistryEvents table in the Advanced hunting schema
|
||||
description: Learn about registry events you can query from the RegistryEvents table of the Advanced hunting schema
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, registryevents, registry, key, subkey, value
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: lomayor
|
||||
author: lomayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# RegistryEvents
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The RegistryEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| EventTime | datetime | Date and time when the event was recorded |
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ActionType | string | Type of activity that triggered the event |
|
||||
| RegistryKey | string | Registry key that the recorded action was applied to |
|
||||
| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to |
|
||||
| RegistryValueName | string | Name of the registry value that the recorded action was applied to |
|
||||
| RegistryValueData | string | Data of the registry value that the recorded action was applied to |
|
||||
| PreviousRegistryValueName | string | Original name of the registry value before it was modified |
|
||||
| PreviousRegistryValueData | string | Original data of the registry value before it was modified |
|
||||
| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event |
|
||||
| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event |
|
||||
| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event |
|
||||
| InitiatingProcessFileName | string | Name of the process that initiated the event |
|
||||
| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event |
|
||||
| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event |
|
||||
| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started |
|
||||
| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event |
|
||||
| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
|
||||
| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
|
||||
| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources |
|
||||
| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Advanced hunting schema reference
|
||||
description: Learn about the tables in the Advanced hunting schema to understand the data you can run threat hunting queries on
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, data
|
||||
description: Learn about the tables in the advanced hunting schema to understand the data you can run threat hunting queries on
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, data
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# Understand the Advanced hunting schema
|
||||
# Understand the advanced hunting schema
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -27,26 +27,26 @@ ms.date: 10/08/2019
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema.
|
||||
The [advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema.
|
||||
|
||||
## Schema tables
|
||||
|
||||
The following reference lists all the tables in the Advanced hunting schema. Each table name links to a page describing the column names for that table.
|
||||
The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table.
|
||||
|
||||
Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the Advanced hunting screen.
|
||||
Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the advanced hunting screen.
|
||||
|
||||
| Table name | Description |
|
||||
|------------|-------------|
|
||||
| **[AlertEvents](advanced-hunting-alertevents-table.md)** | Alerts on Microsoft Defender Security Center |
|
||||
| **[MachineInfo](advanced-hunting-machineinfo-table.md)** | Machine information, including OS information |
|
||||
| **[MachineNetworkInfo](advanced-hunting-machinenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains |
|
||||
| **[ProcessCreationEvents](advanced-hunting-processcreationevents-table.md)** | Process creation and related events |
|
||||
| **[NetworkCommunicationEvents](advanced-hunting-networkcommunicationevents-table.md)** | Network connection and related events |
|
||||
| **[FileCreationEvents](advanced-hunting-filecreationevents-table.md)** | File creation, modification, and other file system events |
|
||||
| **[RegistryEvents](advanced-hunting-registryevents-table.md)** | Creation and modification of registry entries |
|
||||
| **[LogonEvents](advanced-hunting-logonevents-table.md)** | Sign-ins and other authentication events |
|
||||
| **[ImageLoadEvents](advanced-hunting-imageloadevents-table.md)** | DLL loading events |
|
||||
| **[MiscEvents](advanced-hunting-miscevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection |
|
||||
| **[DeviceInfo](advanced-hunting-deviceinfo-table.md)** | Machine information, including OS information |
|
||||
| **[DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains |
|
||||
| **[DeviceProcessEvents](advanced-hunting-deviceprocessevents-table.md)** | Process creation and related events |
|
||||
| **[DeviceNetworkEvents](advanced-hunting-devicenetworkevents-table.md)** | Network connection and related events |
|
||||
| **[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)** | File creation, modification, and other file system events |
|
||||
| **[DeviceRegistryEvents](advanced-hunting-deviceregistryevents-table.md)** | Creation and modification of registry entries |
|
||||
| **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events |
|
||||
| **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events |
|
||||
| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection |
|
||||
| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products |
|
||||
| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available |
|
||||
| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices |
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Use shared queries in Advanced hunting
|
||||
title: Use shared queries in advanced hunting
|
||||
description: Start threat hunting immediately with predefined and shared queries. Share your queries to the public or to your organization.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto, github repo, my queries, shared queries
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, custom detections, schema, kusto, github repo, my queries, shared queries
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
ms.date: 10/08/2019
|
||||
---
|
||||
|
||||
# Use shared queries in Advanced hunting
|
||||
# Use shared queries in advanced hunting
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
@ -54,10 +54,10 @@ You can save a new or existing query so that it is only accessible to you or sha
|
||||
2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query.
|
||||
|
||||
## Access queries in the GitHub repository
|
||||
Microsoft security researchers regularly share Advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/).
|
||||
Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/).
|
||||
|
||||
>[!TIP]
|
||||
>Microsoft security researchers also provide Advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](threat-analytics.md) reports in Microsoft Defender Security Center.
|
||||
>Microsoft security researchers also provide advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](threat-analytics.md) reports in Microsoft Defender Security Center.
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema
|
||||
title: DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema
|
||||
description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the Advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -28,21 +28,21 @@ ms.date: 11/12/2019
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant.
|
||||
Each row in the `DeviceTvmSecureConfigurationAssessment` table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|
|
||||
| Timestamp | datetime |Date and time when the record was generated |
|
||||
| ConfigurationId | string | Unique identifier for a specific configuration |
|
||||
| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls |
|
||||
| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| IsCompliant | boolean | Indicates whether the configuration or policy is properly configured |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|
|
||||
| `Timestamp` | datetime |Date and time when the record was generated |
|
||||
| `ConfigurationId` | string | Unique identifier for a specific configuration |
|
||||
| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls |
|
||||
| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| `IsCompliant` | boolean | Indicates whether the configuration or policy is properly configured |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema
|
||||
title: DeviceTvmSecureConfigurationAssessmentKB table in the advanced hunting schema
|
||||
description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the Advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -28,22 +28,22 @@ ms.date: 11/12/2019
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table.
|
||||
The `DeviceTvmSecureConfigurationAssessmentKB` table in the advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| ConfigurationId | string | Unique identifier for a specific configuration |
|
||||
| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| ConfigurationName | string | Display name of the configuration |
|
||||
| ConfigurationDescription | string | Description of the configuration |
|
||||
| RiskDescription | string | Description of the associated risk |
|
||||
| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
|
||||
| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| ConfigurationBenchmarks | string | List of industry benchmarks recommending the same or similar configuration |
|
||||
| RelatedMitreTechniques | string | List of Mitre ATT&CK framework techniques related to the configuration |
|
||||
| RelatedMitreTactics | string | List of Mitre ATT&CK framework tactics related to the configuration |
|
||||
| `ConfigurationId` | string | Unique identifier for a specific configuration |
|
||||
| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| `ConfigurationName` | string | Display name of the configuration |
|
||||
| `ConfigurationDescription` | string | Description of the configuration |
|
||||
| `RiskDescription` | string | Description of the associated risk |
|
||||
| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
|
||||
| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| `ConfigurationBenchmarks` | string | List of industry benchmarks recommending the same or similar configuration |
|
||||
| `RelatedMitreTechniques` | string | List of Mitre ATT&CK framework techniques related to the configuration |
|
||||
| `RelatedMitreTactics ` | string | List of Mitre ATT&CK framework tactics related to the configuration |
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema
|
||||
description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the Advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities
|
||||
title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema
|
||||
description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -29,22 +29,22 @@ ms.date: 11/12/2019
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table.
|
||||
The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| OSVersion | string | Version of the operating system running on the machine |
|
||||
| OSArchitecture | string | Architecture of the operating system running on the machine |
|
||||
| SoftwareVendor | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| SoftwareName | string | Name of the software product |
|
||||
| SoftwareVersion | string | Version number of the software product |
|
||||
| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| `OSVersion` | string | Version of the operating system running on the machine |
|
||||
| `OSArchitecture` | string | Architecture of the operating system running on the machine |
|
||||
| `SoftwareVendor` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| `SoftwareName` | string | Name of the software product |
|
||||
| `SoftwareVersion` | string | Version number of the software product |
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema
|
||||
description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the Advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB
|
||||
title: DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema
|
||||
description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -28,20 +28,20 @@ ms.date: 11/12/2019
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table.
|
||||
The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| CvssScore | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) |
|
||||
| IsExploitAvailable | boolean | Indicates whether exploit code for the vulnerability is publicly available |
|
||||
| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| LastModifiedTime | datetime | Date and time the item or related metadata was last modified |
|
||||
| PublishedDate | datetime | Date vulnerability was disclosed to public |
|
||||
| VulnerabilityDescription | string | Description of vulnerability and associated risks |
|
||||
| AffectedSoftware | string | List of all software products affected by the vulnerability |
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `CvssScore` | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) |
|
||||
| `IsExploitAvailable` | boolean | Indicates whether exploit code for the vulnerability is publicly available |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| `LastModifiedTime` | datetime | Date and time the item or related metadata was last modified |
|
||||
| `PublishedDate` | datetime | Date vulnerability was disclosed to public |
|
||||
| `VulnerabilityDescription` | string | Description of vulnerability and associated risks |
|
||||
| `AffectedSoftware` | string | List of all software products affected by the vulnerability |
|
||||
|
||||
## Related topics
|
||||
|
||||
|
||||
@ -27,6 +27,7 @@ Method |Return Type |Description
|
||||
:---|:---|:---
|
||||
[Get alert](get-alert-info-by-id.md) | [Alert](alerts.md) | Get a single [alert](alerts.md) object.
|
||||
[List alerts](get-alerts.md) | [Alert](alerts.md) collection | List [alert](alerts.md) collection.
|
||||
[Update alert](get-alerts.md) | [Alert](update-alert.md) | Update specific [alert](alerts.md).
|
||||
[Create alert](create-alert-by-reference.md)|[Alert](alerts.md)|Create an alert based on event data obtained from [Advanced Hunting](run-advanced-query-api.md).
|
||||
[List related domains](get-alert-related-domain-info.md)|Domain collection| List URLs associated with the alert.
|
||||
[List related files](get-alert-related-files-info.md) | [File](files.md) collection | List the [file](files.md) entities that are associated with the [alert](alerts.md).
|
||||
@ -59,19 +60,8 @@ detectionSource | String | Detection source.
|
||||
threatFamilyName | String | Threat family.
|
||||
machineId | String | ID of a [machine](machine.md) entity that is associated with the alert.
|
||||
comments | List of Alert comments | Alert Comment is an object that contains: comment string, createdBy string and createTime date time.
|
||||
alertFiles | List of Alert Files | **This list will be populated on $expand option, see example below** Alert File is an object that contains: sha1, sha256, filePath and fileName.
|
||||
alertIPs | List of Alert IPs | **This list will be populated on $expand option, see example below** Alert IP is an object that contains: ipAddress string field.
|
||||
alertDomains | List of Alert Domains | **This list will be populated on $expand option, see example below** Alert Domain is an object that contains: host string field.
|
||||
|
||||
|
||||
|
||||
## JSON representation:
|
||||
|
||||
- When querying for alert list the regular way (without expand option, e.g. /api/alerts) the expandable properties will not get populated (empty lists)
|
||||
- To expand expandable properties use $expand option (e.g. to expand all send /api/alerts?$expand=files,ips,domains).
|
||||
- When querying single alert all expandable properties will be expanded.
|
||||
- Check out [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md) for more OData examples.
|
||||
|
||||
### Response example for getting single alert:
|
||||
|
||||
```
|
||||
@ -83,12 +73,12 @@ GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-2929
|
||||
"id": "da637084217856368682_-292920499",
|
||||
"incidentId": 66860,
|
||||
"investigationId": 4416234,
|
||||
"investigationState": "Running",
|
||||
"assignedTo": "secop@contoso.com",
|
||||
"severity": "Low",
|
||||
"status": "New",
|
||||
"classification": "TruePositive",
|
||||
"determination": null,
|
||||
"investigationState": "Running",
|
||||
"detectionSource": "WindowsDefenderAtp",
|
||||
"category": "CommandAndControl",
|
||||
"threatFamilyName": null,
|
||||
@ -106,24 +96,6 @@ GET https://api.securitycenter.windows.com/api/alerts/da637084217856368682_-2929
|
||||
"createdBy": "secop@contoso.com",
|
||||
"createdTime": "2019-11-05T14:08:37.8404534Z"
|
||||
}
|
||||
],
|
||||
"alertFiles": [
|
||||
{
|
||||
"sha1": "77e862797dd525fd3e9c3058153247945d0d4cfd",
|
||||
"sha256": "c05823562aee5e6d000b0e041197d5b8303f5aa4eecb49820879b705c926e16e",
|
||||
"filePath": "C:\\Users\\test1212\\AppData\\Local\\Temp\\nsf61D3.tmp.exe",
|
||||
"fileName": "nsf61D3.tmp.exe"
|
||||
}
|
||||
],
|
||||
"alertDomains": [
|
||||
{
|
||||
"host": "login.bullguard.com"
|
||||
}
|
||||
],
|
||||
"alertIps": [
|
||||
{
|
||||
"ipAddress": "91.231.212.53"
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
@ -17,7 +17,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Microsoft Defender ATP Flow connector
|
||||
# Microsoft Power Automate (formerly Microsoft Flow), and Azure Functions
|
||||
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
@ -43,7 +43,7 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a
|
||||
|
||||
```
|
||||
let
|
||||
AdvancedHuntingQuery = "MiscEvents | where ActionType contains 'Anti'",
|
||||
AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti'",
|
||||
|
||||
HuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries",
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user