From 51d426f01769008c1aba0432e89b8113a6f7a0a6 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 16:34:14 -0800 Subject: [PATCH 1/7] AH Schema naming --- .../advanced-hunting-alertevents-table.md | 8 ++++---- .../advanced-hunting-best-practices.md | 18 ++++++++--------- ...=> advanced-hunting-deviceevents-table.md} | 18 ++++++++--------- ...dvanced-hunting-devicefileevents-table.md} | 18 ++++++++--------- ...ed-hunting-deviceimageloadevents-table.md} | 18 ++++++++--------- ...d => advanced-hunting-deviceinfo-table.md} | 20 +++++++++---------- ...vanced-hunting-devicelogonevents-table.md} | 20 +++++++++---------- ...nced-hunting-devicenetworkevents-table.md} | 18 ++++++++--------- ...vanced-hunting-devicenetworkinfo-table.md} | 18 ++++++++--------- ...nced-hunting-deviceprocessevents-table.md} | 18 ++++++++--------- ...ced-hunting-deviceregistryevents-table.md} | 18 ++++++++--------- .../advanced-hunting-query-language.md | 18 ++++++++--------- .../advanced-hunting-schema-reference.md | 18 ++++++++--------- ...nced-hunting-tvm-configassessment-table.md | 4 ++-- ...ced-hunting-tvm-softwareinventory-table.md | 4 ++-- .../microsoft-defender-atp/api-power-bi.md | 2 +- .../attack-surface-reduction.md | 2 +- .../controlled-folders.md | 2 +- .../custom-detection-rules.md | 14 ++++++------- .../exploit-protection.md | 2 +- .../exposed-apis-full-sample-powershell.md | 2 +- .../information-protection-investigation.md | 2 +- .../investigate-behind-proxy.md | 6 +++--- .../network-protection.md | 2 +- .../microsoft-defender-atp/preview.md | 2 +- .../run-advanced-query-api.md | 2 +- .../run-advanced-query-sample-powershell.md | 2 +- .../run-advanced-query-sample-python.md | 2 +- .../threat-and-vuln-mgt-scenarios.md | 8 ++++---- 29 files changed, 143 insertions(+), 143 deletions(-) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-miscevents-table.md => advanced-hunting-deviceevents-table.md} (84%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-filecreationevents-table.md => advanced-hunting-devicefileevents-table.md} (86%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-imageloadevents-table.md => advanced-hunting-deviceimageloadevents-table.md} (83%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-machineinfo-table.md => advanced-hunting-deviceinfo-table.md} (75%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-logonevents-table.md => advanced-hunting-devicelogonevents-table.md} (82%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-networkcommunicationevents-table.md => advanced-hunting-devicenetworkevents-table.md} (83%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-machinenetworkinfo-table.md => advanced-hunting-devicenetworkinfo-table.md} (77%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-processcreationevents-table.md => advanced-hunting-deviceprocessevents-table.md} (88%) rename windows/security/threat-protection/microsoft-defender-atp/{advanced-hunting-registryevents-table.md => advanced-hunting-deviceregistryevents-table.md} (85%) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md index 84eb799e45..b5e080a33e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -33,9 +33,9 @@ For information on other tables in the Advanced hunting schema, see [the Advance | Column name | Data type | Description | |-------------|-----------|-------------| | AlertId | string | Unique identifier for the alert | -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | | Category | string | Type of threat indicator or breach activity identified by the alert | | Title | string | Title of the alert | @@ -43,7 +43,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | SHA1 | string | SHA-1 of the file that the recorded action was applied to | | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | | RemoteIP | string | IP address that was being connected to | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | Table | string | Table that contains the details of the event | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index bb1e594c49..deb89add9d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -41,14 +41,14 @@ Apply these recommendations to get results faster and avoid timeouts while runni ## Query tips and pitfalls ### Queries with process IDs -Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `MachineId` or `ComputerName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`). +Process IDs (PIDs) are recycled in Windows and reused for new processes. On their own, they can't serve as unique identifiers for specific processes. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time. When you join or summarize data around processes, include columns for the machine identifier (either `DeviceId` or `DeviceName`), the process ID (`ProcessId` or `InitiatingProcessId`), and the process creation time (`ProcessCreationTime` or `InitiatingProcessCreationTime`). The following example query finds processes that access more than 10 IP addresses over port 445 (SMB), possibly scanning for file shares. ``` -NetworkCommunicationEvents -| where RemotePort == 445 and EventTime > ago(12h) and InitiatingProcessId !in (0, 4) -| summarize RemoteIPCount=dcount(RemoteIP) by ComputerName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessFileName +DeviceNetworkEvents +| where RemotePort == 445 and Timestamp > ago(12h) and InitiatingProcessId !in (0, 4) +| summarize RemoteIPCount=dcount(RemoteIP) by DeviceName, InitiatingProcessId, InitiatingProcessCreationTime, InitiatingProcessFileName | where RemoteIPCount > 10 ``` @@ -70,17 +70,17 @@ The following examples show various ways to construct a query that looks for the ``` // Non-durable query - do not use -ProcessCreationEvents +DeviceProcessEvents | where ProcessCommandLine == "net stop MpsSvc" | limit 10 // Better query - filters on filename, does case-insensitive matches -ProcessCreationEvents -| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc" +DeviceProcessEvents +| where Timestamp > ago(7d) and FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc" // Best query also ignores quotes -ProcessCreationEvents -| where EventTime > ago(7d) and FileName in~ ("net.exe", "net1.exe") +DeviceProcessEvents +| where Timestamp > ago(7d) and FileName in~ ("net.exe", "net1.exe") | extend CanonicalCommandLine=replace("\"", "", ProcessCommandLine) | where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc" ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md similarity index 84% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 2e6c3ad70f..1acdf557bf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -1,6 +1,6 @@ --- -title: MiscEvents table in the advanced hunting schema -description: Learn about antivirus, firewall, and other event types in the miscellaneous events (MiscEvents) table of the Advanced hunting schema +title: DeviceEvents table in the advanced hunting schema +description: Learn about antivirus, firewall, and other event types in the miscellaneous events (DeviceEvents) table of the Advanced hunting schema keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# MiscEvents +# DeviceEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous events or MiscEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -45,7 +45,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | AccountName |string | User name of the account | | AccountSid | string | Security Identifier (SID) of the account | | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | +| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | | ProcessId | int | Process ID (PID) of the newly created process | | ProcessCommandLine | string | Command line used to create the new process | | ProcessCreationTime | datetime | Date and time the process was created | @@ -76,7 +76,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | | InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | | InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md similarity index 86% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 957282b72c..08c61045ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -1,7 +1,7 @@ --- -title: FileCreationEvents table in the Advanced hunting schema -description: Learn about file-related events in the FileCreationEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, filecreationevents, files, path, hash, sha1, sha256, md5 +title: DeviceFileEvents table in the Advanced hunting schema +description: Learn about file-related events in the DeviceFileEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5 search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# FileCreationEvents +# DeviceFileEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The FileCreationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. +The DeviceFileEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -66,7 +66,7 @@ For information on other tables in the Advanced hunting schema, see [the Advanc | RequestAccountName | string | User name of account used to remotely initiate the activity | | RequestAccountDomain | string | Domain of the account used to remotely initiate the activity | | RequestAccountSid | string | Security Identifier (SID) of the account to remotely initiate the activity | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | | SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection | | SensitivitySubLabel | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md similarity index 83% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md index 68ceff1055..ebfd8dd80a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md @@ -1,7 +1,7 @@ --- -title: ImageLoadEvents table in the Advanced hunting schema -description: Learn about DLL loading events in the ImageLoadEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, imageloadevents, DLL loading, library, file image +title: DeviceImageLoadEvents table in the Advanced hunting schema +description: Learn about DLL loading events in the DeviceImageLoadEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# ImageLoadEvents +# DeviceImageLoadEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The ImageLoadEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. +The DeviceImageLoadEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -55,7 +55,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md similarity index 75% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md index a986602549..7d8fb7823b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md @@ -1,7 +1,7 @@ --- -title: MachineInfo table in the Advanced hunting schema -description: Learn about OS, computer name, and other machine information in the MachineInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, machineinfo, device, machine, OS, platform, users +title: DeviceInfo table in the Advanced hunting schema +description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# MachineInfo +# DeviceInfo **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The MachineInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. +The DeviceInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ClientVersion | string | Version of the endpoint agent or sensor running on the machine | | PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | | OSArchitecture | string | Architecture of the operating system running on the machine | @@ -42,8 +42,8 @@ For information on other tables in the Advanced hunting schema, see [the Advance | OSBuild | string | Build version of the operating system running on the machine | | IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | | LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | -| RegistryMachineTag | string | Machine tag added through the registry | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| RegistryDeviceTag | string | Machine tag added through the registry | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | OSVersion | string | Version of the operating system running on the machine | | MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md similarity index 82% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md index eb6044fda7..196bdde977 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md @@ -1,7 +1,7 @@ --- -title: LogonEvents table in the Advanced hunting schema -description: Learn about authentication or sign-in events in the LogonEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, logonevents, authentication, logon, sign in +title: DeviceLogonEvents table in the Advanced hunting schema +description: Learn about authentication or sign-in events in the DeviceLogonEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# LogonEvents +# DeviceLogonEvents **Applies to:** @@ -26,22 +26,22 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The LogonEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. +The DeviceLogonEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string |Type of activity that triggered the event | | AccountDomain | string | Domain of the account | | AccountName | string | User name of the account | | AccountSid | string | Security Identifier (SID) of the account | | LogonType | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

- **Batch** - Session initiated by scheduled tasks

- **Service** - Session initiated by services as they start
| | LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| RemoteComputerName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | +| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | | RemoteIP | string | IP address that was being connected to | | RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | | RemotePort | int | TCP port on the remote device that was being connected to | @@ -62,7 +62,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | | IsLocalAdmin | boolean | Boolean indicator of whether the user is a local administrator on the machine | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md similarity index 83% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md index 5485d2b86e..581b173d15 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md @@ -1,7 +1,7 @@ --- -title: NetworkCommunicationEvents table in the Advanced hunting schema -description: Learn about network connection events you can query from the NetworkCommunicationEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, networkcommunicationevents, network connection, remote ip, local ip +title: DeviceNetworkEvents table in the Advanced hunting schema +description: Learn about network connection events you can query from the DeviceNetworkEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# NetworkCommunicationEvents +# DeviceNetworkEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The NetworkCommunicationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. +The DeviceNetworkEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | RemoteIP | string | IP address that was being connected to | | RemotePort | int | TCP port on the remote device that was being connected to | @@ -59,7 +59,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | | InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | | InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md similarity index 77% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md index a09d2619f2..66f0663d23 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md @@ -1,7 +1,7 @@ --- -title: MachineNetworkInfo table in the Advanced hunting schema -description: Learn about network configuration information in the MachineNetworkInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, machinenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel +title: DeviceNetworkInfo table in the Advanced hunting schema +description: Learn about network configuration information in the DeviceNetworkInfo table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# MachineNetworkInfo +# DeviceNetworkInfo **Applies to:** @@ -26,16 +26,16 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The MachineNetworkInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. +The DeviceNetworkInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | NetworkAdapterName | string | Name of the network adapter | | MacAddress | string | MAC address of the network adapter | | NetworkAdapterType | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md similarity index 88% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md index 43746ac557..42ed9a3829 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md @@ -1,7 +1,7 @@ --- -title: ProcessCreationEvents table in the Advanced hunting schema -description: Learn about the process spawning or creation events in the ProcessCreationEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, processcreationevents, process id, command line +title: DeviceProcessEvents table in the Advanced hunting schema +description: Learn about the process spawning or creation events in the DeviceProcessEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# ProcessCreationEvents +# DeviceProcessEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The ProcessCreationEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. +The DeviceProcessEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | FileName | string | Name of the file that the recorded action was applied to | | FolderPath | string | Folder containing the file that the recorded action was applied to | @@ -67,7 +67,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md similarity index 85% rename from windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md rename to windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md index 05c6b7386b..fee6397cd2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md @@ -1,7 +1,7 @@ --- -title: RegistryEvents table in the Advanced hunting schema -description: Learn about registry events you can query from the RegistryEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, registryevents, registry, key, subkey, value +title: DeviceRegistryEvents table in the Advanced hunting schema +description: Learn about registry events you can query from the DeviceRegistryEvents table of the Advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# RegistryEvents +# DeviceRegistryEvents **Applies to:** @@ -26,15 +26,15 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The RegistryEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. +The DeviceRegistryEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| EventTime | datetime | Date and time when the event was recorded | -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| Timestamp | datetime | Date and time when the event was recorded | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | ActionType | string | Type of activity that triggered the event | | RegistryKey | string | Registry key that the recorded action was applied to | | RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | @@ -57,7 +57,7 @@ For information on other tables in the Advanced hunting schema, see [the Advance | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | | InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | | InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns | +| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md index 405215c2aa..33817ad10f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md @@ -33,16 +33,16 @@ In Microsoft Defender Security Center, go to **Advanced hunting** to run your fi ```kusto // Finds PowerShell execution events that could involve a download. -ProcessCreationEvents -| where EventTime > ago(7d) +DeviceProcessEvents +| where Timestamp > ago(7d) | where FileName in ("powershell.exe", "POWERSHELL.EXE", "powershell_ise.exe", "POWERSHELL_ISE.EXE") | where ProcessCommandLine has "Net.WebClient" or ProcessCommandLine has "DownloadFile" or ProcessCommandLine has "Invoke-WebRequest" or ProcessCommandLine has "Invoke-Shellcode" or ProcessCommandLine contains "http:" -| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine -| top 100 by EventTime +| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine +| top 100 by Timestamp ``` This is how it will look like in Advanced hunting. @@ -54,16 +54,16 @@ The query starts with a short comment describing what it is for. This helps if y ```kusto // Finds PowerShell execution events that could involve a download. -ProcessCreationEvents +DeviceProcessEvents ``` -The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by adding with the table name `ProcessCreationEvents` and add piped elements as needed. +The query itself will typically start with a table name followed by a series of elements started by a pipe (`|`). In this example, we start by adding with the table name `DeviceProcessEvents` and add piped elements as needed. ### Set the time range The first piped element is a time filter scoped within the previous seven days. Keeping the time range as narrow as possible ensures that queries perform well, return manageable results, and don't time out. ```kusto -| where EventTime > ago(7d) +| where Timestamp > ago(7d) ``` ### Search for specific executable files The time range is immediately followed by a search for files representing the PowerShell application. @@ -85,8 +85,8 @@ Afterwards, the query looks for command lines that are typically used with Power Now that your query clearly identifies the data you want to locate, you can add elements that define what the results look like. `project` returns specific columns and `top` limits the number of results, making the results well-formatted and reasonably large and easy to process. ```kusto -| project EventTime, ComputerName, InitiatingProcessFileName, FileName, ProcessCommandLine -| top 100 by EventTime +| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine +| top 100 by Timestamp ``` Click **Run query** to see the results. You can expand the screen view so you can focus on your hunting query and the results. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index 1ee69ec5ad..ad7829bfa9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -38,15 +38,15 @@ Table and column names are also listed within the Microsoft Defender Security Ce | Table name | Description | |------------|-------------| | **[AlertEvents](advanced-hunting-alertevents-table.md)** | Alerts on Microsoft Defender Security Center | -| **[MachineInfo](advanced-hunting-machineinfo-table.md)** | Machine information, including OS information | -| **[MachineNetworkInfo](advanced-hunting-machinenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains | -| **[ProcessCreationEvents](advanced-hunting-processcreationevents-table.md)** | Process creation and related events | -| **[NetworkCommunicationEvents](advanced-hunting-networkcommunicationevents-table.md)** | Network connection and related events | -| **[FileCreationEvents](advanced-hunting-filecreationevents-table.md)** | File creation, modification, and other file system events | -| **[RegistryEvents](advanced-hunting-registryevents-table.md)** | Creation and modification of registry entries | -| **[LogonEvents](advanced-hunting-logonevents-table.md)** | Sign-ins and other authentication events | -| **[ImageLoadEvents](advanced-hunting-imageloadevents-table.md)** | DLL loading events | -| **[MiscEvents](advanced-hunting-miscevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | +| **[DeviceInfo](advanced-hunting-deviceinfo-table.md)** | Machine information, including OS information | +| **[DeviceNetworkInfo](advanced-hunting-devicenetworkinfo-table.md)** | Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains | +| **[DeviceProcessEvents](advanced-hunting-deviceprocessevents-table.md)** | Process creation and related events | +| **[DeviceNetworkEvents](advanced-hunting-devicenetworkevents-table.md)** | Network connection and related events | +| **[DeviceFileEvents](advanced-hunting-devicefileevents-table.md)** | File creation, modification, and other file system events | +| **[DeviceRegistryEvents](advanced-hunting-deviceregistryevents-table.md)** | Creation and modification of registry entries | +| **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events | +| **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events | +| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | | **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Vulnerabilities in your software inventory | | **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Publicly-available vulnerabilities and whether they exist in your software inventory | | **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Security configuration assessment information | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md index 736db7d11f..3fd747d1c7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md @@ -34,8 +34,8 @@ For information on other tables in the Advanced hunting schema, see [the Advance | Column name | Data type | Description | |-------------|-----------|-------------| -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| | Timestamp | datetime |Date and time when the record was generated | | ConfigurationId | string | Unique identifier for a specific configuration | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md index dc92507b8e..63fa5e1590 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md @@ -35,8 +35,8 @@ For information on other tables in the Advanced hunting schema, see [the Advance | Column name | Data type | Description | |-------------|-----------|-------------| -| MachineId | string | Unique identifier for the machine in the service | -| ComputerName | string | Fully qualified domain name (FQDN) of the machine | +| DeviceId | string | Unique identifier for the machine in the service | +| DeviceName | string | Fully qualified domain name (FQDN) of the machine | | OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | | OSVersion | string | Version of the operating system running on the machine | | OSArchitecture | string | Architecture of the operating system running on the machine | diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md index 2eaa43daee..cd73aee642 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md @@ -43,7 +43,7 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a ``` let - AdvancedHuntingQuery = "MiscEvents | where ActionType contains 'Anti'", + AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti'", HuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries", diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 772ce99ae9..84f22f9ef0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -51,7 +51,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](advanced-h Here is an example query: ```PowerShell -MiscEvents +DeviceEvents | where ActionType startswith 'Asr' ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index b751dd036f..44d145c9e9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -56,7 +56,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](https://do Here is an example query ```PowerShell -MiscEvents +DeviceEvents | where ActionType in ('ControlledFolderAccessViolationAudited','ControlledFolderAccessViolationBlocked') ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index fb3a52f9f4..854e4f2e9b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -34,17 +34,17 @@ Custom detection rules built from [Advanced hunting](advanced-hunting-overview.m In Microsoft Defender Security Center, go to **Advanced hunting** and select an existing query or create a new query. When using an new query, run the query to identify errors and understand possible results. #### Required columns in the query results -To use a query for a custom detection rule, the query must return the `EventTime`, `MachineId`, and `ReportId` columns in the results. Simple queries, such as those that don’t use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. +To use a query for a custom detection rule, the query must return the `Timestamp`, `DeviceId`, and `ReportId` columns in the results. Simple queries, such as those that don’t use the `project` or `summarize` operator to customize or aggregate results, typically return these common columns. -There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `MachineId`, you can still return `EventTime` and `ReportId` by getting them from the most recent event involving each machine. +There are various ways to ensure more complex queries return these columns. For example, if you prefer to aggregate and count by `DeviceId`, you can still return `Timestamp` and `ReportId` by getting them from the most recent event involving each machine. -The sample query below counts the number of unique machines (`MachineId`) with antivirus detections and uses this count to find only the machines with more than five detections. To return the latest `EventTime` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. +The sample query below counts the number of unique machines (`DeviceId`) with antivirus detections and uses this count to find only the machines with more than five detections. To return the latest `Timestamp` and the corresponding `ReportId`, it uses the `summarize` operator with the `arg_max` function. ``` -MiscEvents -| where EventTime > ago(7d) +DeviceEvents +| where Timestamp > ago(7d) | where ActionType == "AntivirusDetection" -| summarize (EventTime, ReportId)=arg_max(EventTime, ReportId), count() by MachineId +| summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count() by DeviceId | where count_ > 5 ``` @@ -76,7 +76,7 @@ Whenever a rule runs, similar detections on the same machine could be aggregated Your custom detection rule can automatically take actions on files or machines that are returned by the query. #### Actions on machines -These actions are applied to machines in the `MachineId` column of the query results: +These actions are applied to machines in the `DeviceId` column of the query results: - **Isolate machine** — applies full network isolation, preventing the machine from connecting to any application or service, except for the Microsoft Defender ATP service. [Learn more about machine isolation](respond-machine-alerts.md#isolate-machines-from-the-network) - **Collect investigation package** — collects machine information in a ZIP file. [Learn more about the investigation package](respond-machine-alerts.md#collect-investigation-package-from-machines) - **Run antivirus scan** — performs a full Windows Defender Antivirus scan on the machine diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md index e47d2c93c1..2642c7655d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md @@ -54,7 +54,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](https://do Here is an example query: ```PowerShell -MiscEvents +DeviceEvents | where ActionType startswith 'ExploitGuard' and ActionType !contains 'NetworkProtection' ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md index e1397a16e7..e66b4eade4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md @@ -99,7 +99,7 @@ Foreach($alert in $alerts) $commaSeparatedMachines = '"{0}"' -f ($machinesToInvestigate -join '","') -$query = "NetworkCommunicationEvents +$query = "DeviceNetworkEvents | where MachineId in ($commaSeparatedMachines) | where RemoteUrl == `"$suspiciousUrl`" | summarize ConnectionsCount = count() by MachineId" diff --git a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md index 7578bad95e..6f16b9a43a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/information-protection-investigation.md @@ -59,4 +59,4 @@ Learn how to use data sensitivity labels to prioritize incident investigation. >[!TIP] ->These data points are also exposed through the ‘FileCreationEvents’ in advanced hunting, allowing advanced queries and schedule detection to take into account sensitivity labels and file protection status. \ No newline at end of file +>These data points are also exposed through the ‘DeviceFileEvents’ in advanced hunting, allowing advanced queries and schedule detection to take into account sensitivity labels and file protection status. \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md index 487d24f359..4e7758c7da 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-behind-proxy.md @@ -60,12 +60,12 @@ Event's information: ## Hunt for connection events using advanced hunting -All new connection events are available for you to hunt on through advanced hunting as well. Since these events are connection events, you can find them under the NetworkCommunicationEvents table under the `ConnecionSuccess` action type. +All new connection events are available for you to hunt on through advanced hunting as well. Since these events are connection events, you can find them under the DeviceNetworkEvents table under the `ConnecionSuccess` action type. Using this simple query will show you all the relevant events: ``` -NetworkCommunicationEvents +DeviceNetworkEvents | where ActionType == "ConnectionSuccess" | take 10 ``` @@ -77,7 +77,7 @@ You can also filter out events that are related to connection to the proxy itse Use the following query to filter out the connections to the proxy: ``` -NetworkCommunicationEvents +DeviceNetworkEvents | where ActionType == "ConnectionSuccess" and RemoteIP != "ProxyIP" | take 10 ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index 6c0c0b5d21..b1a6786f57 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -57,7 +57,7 @@ You can query Microsoft Defender ATP data by using [Advanced hunting](https://do Here is an example query ```PowerShell -MiscEvents +DeviceEvents | where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked') ``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 7173007d17..07e1d96848 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -46,7 +46,7 @@ The following features are included in the preview release: - [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy). -- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table)
You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. +- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table)
You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. - [Threat & Vulnerability Management role-based access controls](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
You can now use the new permissions to allow maximum flexibility to create SecOps-oriented roles, Threat & Vulnerability Management-oriented roles, or hybrid roles so only authorized users are accessing specific data to do their task. You can also achieve even further granularity by specifying whether a Threat & Vulnerability Management role can only view vulnerability-related data, or can create and manage remediation and exceptions. diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index 8dc833cda8..bece592d00 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -81,7 +81,7 @@ Here is an example of the request. POST https://api.securitycenter.windows.com/api/advancedqueries/run Content-type: application/json { - "Query":"ProcessCreationEvents + "Query":"DeviceProcessEvents | where InitiatingProcessFileName =~ \"powershell.exe\" | where ProcessCommandLine contains \"appdata\" | project EventTime, FileName, InitiatingProcessFileName diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md index e33a799eb0..15aded57d0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md @@ -70,7 +70,7 @@ where Run the following query: ``` -$query = 'RegistryEvents | limit 10' # Paste your own query here +$query = 'DeviceRegistryEvents | limit 10' # Paste your own query here $url = "https://api.securitycenter.windows.com/api/advancedqueries/run" $headers = @{ diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md index f8b07f534c..6c4831e501 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md @@ -73,7 +73,7 @@ where Run the following query: ``` -query = 'RegistryEvents | limit 10' # Paste your own query here +query = 'DeviceRegistryEvents | limit 10' # Paste your own query here url = "https://api.securitycenter.windows.com/api/advancedqueries/run" headers = { diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 13b98ef44d..93c0a3388e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -173,11 +173,11 @@ DeviceTvmSoftwareInventoryVulnerabilities | join kind=inner(DeviceTvmSoftwareVulnerabilitiesKB) on CveId | where IsExploitAvailable == 1 and CvssScore >= 7 | summarize NumOfVulnerabilities=dcount(CveId), -ComputerName=any(ComputerName) by MachineId -| join kind =inner(AlertEvents) on MachineId +DeviceName=any(DeviceName) by DeviceId +| join kind =inner(AlertEvents) on DeviceId | summarize NumOfVulnerabilities=any(NumOfVulnerabilities), -ComputerName=any(ComputerName) by MachineId, AlertId -| project ComputerName, NumOfVulnerabilities, AlertId +DeviceName=any(DeviceName) by DeviceId, AlertId +| project DeviceName, NumOfVulnerabilities, AlertId | order by NumOfVulnerabilities desc ``` From 7b7d43e9d340c7cf91386461d22e03cd846cd5f1 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 16:37:49 -0800 Subject: [PATCH 2/7] Update advanced-hunting-deviceevents-table.md --- .../advanced-hunting-deviceevents-table.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 1acdf557bf..3f640784e5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -1,6 +1,6 @@ --- title: DeviceEvents table in the advanced hunting schema -description: Learn about antivirus, firewall, and other event types in the miscellaneous events (DeviceEvents) table of the Advanced hunting schema +description: Learn about antivirus, firewall, and other event types in the miscellaneous device events (DeviceEvents) table of the Advanced hunting schema keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous device events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). From 2eb85ee3aaf78841d0acbd19d30e09d90fdfd56f Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 17:06:53 -0800 Subject: [PATCH 3/7] TOC & redir for ah schema change --- .openpublishing.redirection.json | 55 ++++++++++++++++++++--- windows/security/threat-protection/TOC.md | 18 ++++---- 2 files changed, 59 insertions(+), 14 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 551ce8b897..4852c7c178 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -956,6 +956,11 @@ "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", "redirect_document_id": false @@ -966,6 +971,51 @@ "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", "redirect_document_id": true @@ -1657,11 +1707,6 @@ "redirect_document_id": true }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", -"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", -"redirect_document_id": true -}, -{ "source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md", "redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score", "redirect_document_id": true diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 1df34b54fd..d3f9b8cf3b 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -114,15 +114,15 @@ #### [Advanced hunting schema reference]() ##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) ##### [AlertEvents](microsoft-defender-atp/advanced-hunting-alertevents-table.md) -##### [FileCreationEvents](microsoft-defender-atp/advanced-hunting-filecreationevents-table.md) -##### [ImageLoadEvents](microsoft-defender-atp/advanced-hunting-imageloadevents-table.md) -##### [LogonEvents](microsoft-defender-atp/advanced-hunting-logonevents-table.md) -##### [MachineInfo](microsoft-defender-atp/advanced-hunting-machineinfo-table.md) -##### [MachineNetworkInfo](microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md) -##### [MiscEvents](microsoft-defender-atp/advanced-hunting-miscevents-table.md) -##### [NetworkCommunicationEvents](microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md) -##### [ProcessCreationEvents](microsoft-defender-atp/advanced-hunting-processcreationevents-table.md) -##### [RegistryEvents](microsoft-defender-atp/advanced-hunting-registryevents-table.md) +##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md) +##### [DeviceImageLoadEvents](microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md) +##### [DeviceLogonEvents](microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md) +##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md) +##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md) +##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md) +##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md) +##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md) +##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md) ##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md) ##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md) ##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md) From 3325a4ea9ea5cb0ead75e3eb4d80ce30e922f79e Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 17:31:13 -0800 Subject: [PATCH 4/7] Undo changes to API topics --- .../exposed-apis-full-sample-powershell.md | 4 ++-- .../microsoft-defender-atp/run-advanced-query-api.md | 2 +- .../run-advanced-query-sample-powershell.md | 2 +- .../run-advanced-query-sample-python.md | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md index e66b4eade4..6314bce713 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell.md @@ -32,7 +32,7 @@ In this section we share PowerShell samples to >**Prerequisite**: You first need to [create an app](apis-intro.md). -## Preparation Instructions +## Preparation instructions - Open a PowerShell window. - If your policy does not allow you to run the PowerShell commands, you can run the below command: @@ -99,7 +99,7 @@ Foreach($alert in $alerts) $commaSeparatedMachines = '"{0}"' -f ($machinesToInvestigate -join '","') -$query = "DeviceNetworkEvents +$query = "NetworkCommunicationEvents | where MachineId in ($commaSeparatedMachines) | where RemoteUrl == `"$suspiciousUrl`" | summarize ConnectionsCount = count() by MachineId" diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index bece592d00..8dc833cda8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -81,7 +81,7 @@ Here is an example of the request. POST https://api.securitycenter.windows.com/api/advancedqueries/run Content-type: application/json { - "Query":"DeviceProcessEvents + "Query":"ProcessCreationEvents | where InitiatingProcessFileName =~ \"powershell.exe\" | where ProcessCommandLine contains \"appdata\" | project EventTime, FileName, InitiatingProcessFileName diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md index 15aded57d0..e33a799eb0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md @@ -70,7 +70,7 @@ where Run the following query: ``` -$query = 'DeviceRegistryEvents | limit 10' # Paste your own query here +$query = 'RegistryEvents | limit 10' # Paste your own query here $url = "https://api.securitycenter.windows.com/api/advancedqueries/run" $headers = @{ diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md index 6c4831e501..f8b07f534c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md @@ -73,7 +73,7 @@ where Run the following query: ``` -query = 'DeviceRegistryEvents | limit 10' # Paste your own query here +query = 'RegistryEvents | limit 10' # Paste your own query here url = "https://api.securitycenter.windows.com/api/advancedqueries/run" headers = { From 2e8f3bd8986fd7811f1104d5d5c4a85d5be25c73 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 13 Dec 2019 18:16:52 -0800 Subject: [PATCH 5/7] Name capping and backticks --- windows/security/threat-protection/TOC.md | 2 +- .../advanced-hunting-alertevents-table.md | 34 +++--- .../advanced-hunting-best-practices.md | 4 +- .../advanced-hunting-deviceevents-table.md | 101 +++++++++--------- ...advanced-hunting-devicefileevents-table.md | 88 +++++++-------- ...ced-hunting-deviceimageloadevents-table.md | 60 +++++------ .../advanced-hunting-deviceinfo-table.md | 38 +++---- ...dvanced-hunting-devicelogonevents-table.md | 76 ++++++------- ...anced-hunting-devicenetworkevents-table.md | 68 ++++++------ ...dvanced-hunting-devicenetworkinfo-table.md | 40 +++---- ...anced-hunting-deviceprocessevents-table.md | 84 +++++++-------- ...nced-hunting-deviceregistryevents-table.md | 64 +++++------ .../advanced-hunting-overview.md | 14 +-- .../advanced-hunting-query-language.md | 22 ++-- .../advanced-hunting-schema-reference.md | 20 ++-- .../advanced-hunting-shared-queries.md | 8 +- ...nced-hunting-tvm-configassessment-table.md | 26 ++--- ...vanced-hunting-tvm-secureconfigkb-table.md | 28 ++--- ...ced-hunting-tvm-softwareinventory-table.md | 28 ++--- ...hunting-tvm-softwarevulnerability-table.md | 24 ++--- .../attack-surface-reduction.md | 2 +- .../controlled-folders.md | 2 +- .../custom-detection-rules.md | 4 +- .../microsoft-defender-atp/evaluation-lab.md | 2 +- .../exploit-protection.md | 2 +- .../network-protection.md | 2 +- .../overview-custom-detections.md | 4 +- .../microsoft-defender-atp/preview.md | 2 +- .../threat-and-vuln-mgt-scenarios.md | 4 +- .../whats-new-in-microsoft-defender-atp.md | 4 +- 30 files changed, 429 insertions(+), 428 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index d3f9b8cf3b..01d818fb3c 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -128,7 +128,7 @@ ##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md) ##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md) #### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) -#### [Stream Advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) +#### [Stream advanced hunting events to Azure Event Hubs](microsoft-defender-atp/raw-data-export-event-hub.md) #### [Custom detections]() ##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md index b5e080a33e..e2792a2fb2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md @@ -1,6 +1,6 @@ --- -title: AlertEvents table in the Advanced hunting schema -description: Learn about alert generation events in the AlertEvents table of the Advanced hunting schema +title: AlertEvents table in the advanced hunting schema +description: Learn about alert generation events in the AlertEvents table of the advanced hunting schema keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, alertevents, alert, severity, category search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -26,25 +26,25 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The AlertEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. +The `AlertEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about alerts on Microsoft Defender Security Center. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| AlertId | string | Unique identifier for the alert | -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | -| Category | string | Type of threat indicator or breach activity identified by the alert | -| Title | string | Title of the alert | -| FileName | string | Name of the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| RemoteIP | string | IP address that was being connected to | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| Table | string | Table that contains the details of the event | +| `AlertId` | string | Unique identifier for the alert | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `Severity` | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert | +| `Category` | string | Type of threat indicator or breach activity identified by the alert | +| `Title` | string | Title of the alert | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | +| `RemoteIP` | string | IP address that was being connected to | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `Table` | string | Table that contains the details of the event | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md index deb89add9d..5c0384c664 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices.md @@ -1,6 +1,6 @@ --- -title: Query best practices for Advanced hunting -description: Learn how to construct fast, efficient, and error-free threat hunting queries when using Advanced hunting +title: Query best practices for advanced hunting +description: Learn how to construct fast, efficient, and error-free threat hunting queries when using advanced hunting keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto, avoid timeout, command lines, process id search.product: eADQiWindows 10XVcnh search.appverid: met150 diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index 3f640784e5..aed7f010df 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -1,7 +1,7 @@ --- title: DeviceEvents table in the advanced hunting schema -description: Learn about antivirus, firewall, and other event types in the miscellaneous device events (DeviceEvents) table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard +description: Learn about antivirus, firewall, and other event types in the miscellaneous device events (DeviceEvents) table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, security events, antivirus, firewall, exploit guard, MiscEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,58 +26,59 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous device events or DeviceEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous device events or `DeviceEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| AccountDomain | string | Domain of the account | -| AccountName |string | User name of the account | -| AccountSid | string | Security Identifier (SID) of the account | -| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | -| ProcessId | int | Process ID (PID) of the newly created process | -| ProcessCommandLine | string | Command line used to create the new process | -| ProcessCreationTime | datetime | Date and time the process was created | -| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | -| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| RegistryKey | string | Registry key that the recorded action was applied to | -| RegistryValueName | string | Name of the registry value that the recorded action was applied to | -| RegistryValueData | string | Data of the registry value that the recorded action was applied to | -| RemoteIP | string | IP address that was being connected to | -| RemotePort | int | TCP port on the remote device that was being connected to | -| LocalIP | string | IP address assigned to the local machine used during communication | -| LocalPort | int | TCP port on the local machine used during communication | -| FileOriginUrl | string | URL where the file was downloaded from | -| FileOriginIP | string | IP address where the file was downloaded from | -| AdditionalFields | string | Additional information about the event in JSON array format | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `AccountDomain` | string | Domain of the account | +| `AccountName |string | User name of the account | +| `AccountSid` | string | Security Identifier (SID) of the account | +| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | +| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | +| `ProcessId` | int | Process ID (PID) of the newly created process | +| `ProcessCommandLine` | string | Command line used to create the new process | +| `ProcessCreationTime` | datetime | Date and time the process was created | +| `ProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `RegistryKey` | string | Registry key that the recorded action was applied to | +| `RegistryValueName` | string | Name of the registry value that the recorded action was applied to | +| `RegistryValueData` | string | Data of the registry value that the recorded action was applied to | +| `RemoteIP` | string | IP address that was being connected to | +| `RemotePort` | int | TCP port on the remote device that was being connected to | +| `LocalIP` | string | IP address assigned to the local machine used during communication | +| `LocalPort` | int | TCP port on the local machine used during communication | +| `FileOriginUrl` | string | URL where the file was downloaded from | +| `FileOriginIP` | string | IP address where the file was downloaded from | +| `AdditionalFields` | string | Additional information about the event in JSON array format | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | + ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 08c61045ad..7e519fa914 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceFileEvents table in the Advanced hunting schema -description: Learn about file-related events in the DeviceFileEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5 +title: DeviceFileEvents table in the advanced hunting schema +description: Learn about file-related events in the DeviceFileEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicefileevents, files, path, hash, sha1, sha256, md5, FileCreationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,51 +26,51 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceFileEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. +The `DeviceFileEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| FileOriginUrl | string | URL where the file was downloaded from | -| FileOriginReferrerUrl | string | URL of the web page that links to the downloaded file | -| FileOriginIP | string | IP address where the file was downloaded from | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| RequestProtocol | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS | -| ShareName | string | Name of shared folder containing the file | -| RequestSourceIP | string | IPv4 or IPv6 address of the remote device that initiated the activity | -| RequestSourcePort | string | Source port on the remote device that initiated the activity | -| RequestAccountName | string | User name of account used to remotely initiate the activity | -| RequestAccountDomain | string | Domain of the account used to remotely initiate the activity | -| RequestAccountSid | string | Security Identifier (SID) of the account to remotely initiate the activity | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | -| SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection | -| SensitivitySubLabel | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | -| IsAzureInfoProtectionApplied | boolean | Indicates whether the file is encrypted by Azure Information Protection | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `FileOriginUrl` | string | URL where the file was downloaded from | +| `FileOriginReferrerUrl` | string | URL of the web page that links to the downloaded file | +| `FileOriginIP` | string | IP address where the file was downloaded from | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessIntegrityLevel` | string` | integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `RequestProtocol` | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS | +| `ShareName` | string | Name of shared folder containing the file | +| `RequestSourceIP` | string | IPv4 or IPv6 address of the remote device that initiated the activity | +| `RequestSourcePort` | string | Source port on the remote device that initiated the activity | +| `RequestAccountName` | string | User name of account used to remotely initiate the activity | +| `RequestAccountDomain` | string | Domain of the account used to remotely initiate the activity | +| `RequestAccountSid` | string | Security Identifier (SID) of the account to remotely initiate the activity | +| `ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `SensitivityLabel` | string | Label applied to an email, file, or other content to classify it for information protection | +| `SensitivitySubLabel` | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | +| `IsAzureInfoProtectionApplied` | boolean | Indicates whether the file is encrypted by Azure Information Protection | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md index ebfd8dd80a..e8acfd67d4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceImageLoadEvents table in the Advanced hunting schema -description: Learn about DLL loading events in the DeviceImageLoadEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image +title: DeviceImageLoadEvents table in the advanced hunting schema +description: Learn about DLL loading events in the DeviceImageLoadEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceimageloadevents, DLL loading, library, file image, ImageLoadEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,37 +26,37 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceImageLoadEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. +The `DeviceImageLoadEvents table` in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md index 7d8fb7823b..16a90f67ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md @@ -1,7 +1,7 @@ --- -title: DeviceInfo table in the Advanced hunting schema -description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users +title: DeviceInfo table in the advanced hunting schema +description: Learn about OS, computer name, and other machine information in the DeviceInfo table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, deviceinfo, device, machine, OS, platform, users, MachineInfo search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,26 +26,26 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. +The `DeviceInfo` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ClientVersion | string | Version of the endpoint agent or sensor running on the machine | -| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | -| OSArchitecture | string | Architecture of the operating system running on the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | -| OSBuild | string | Build version of the operating system running on the machine | -| IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | -| LoggedOnUsers | string | List of all users that are logged on the machine at the time of the event in JSON array format | -| RegistryDeviceTag | string | Machine tag added through the registry | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| OSVersion | string | Version of the operating system running on the machine | -| MachineGroup | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ClientVersion` | string | Version of the endpoint agent or sensor running on the machine | +| `PublicIP` | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy | +| `OSArchitecture` | string | Architecture of the operating system running on the machine | +| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7 | +| `OSBuild` | string | Build version of the operating system running on the machine | +| `IsAzureADJoined` | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory | +| `LoggedOnUsers` | string | List of all users that are logged on the machine at the time of the event in JSON array format | +| `RegistryDeviceTag` | string | Machine tag added through the registry | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | +| `OSVersion` | string | Version of the operating system running on the machine | +| `MachineGroup` | string | Machine group of the machine. This group is used by role-based access control to determine access to the machine | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md index 196bdde977..8177e49c74 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceLogonEvents table in the Advanced hunting schema -description: Learn about authentication or sign-in events in the DeviceLogonEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in +title: DeviceLogonEvents table in the advanced hunting schema +description: Learn about authentication or sign-in events in the DeviceLogonEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicelogonevents, authentication, logon, sign in, LogonEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,45 +26,45 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceLogonEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. +The `DeviceLogonEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string |Type of activity that triggered the event | -| AccountDomain | string | Domain of the account | -| AccountName | string | User name of the account | -| AccountSid | string | Security Identifier (SID) of the account | -| LogonType | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

- **Batch** - Session initiated by scheduled tasks

- **Service** - Session initiated by services as they start
| -| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| RemoteDeviceName | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | -| RemoteIP | string | IP address that was being connected to | -| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| RemotePort | int | TCP port on the remote device that was being connected to | -| AdditionalFields | string | Additional information about the event in JSON array format | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | -| IsLocalAdmin | boolean | Boolean indicator of whether the user is a local administrator on the machine | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string |Type of activity that triggered the event | +| `AccountDomain` | string | Domain of the account | +| `AccountName` | string | User name of the account | +| `AccountSid` | string | Security Identifier (SID) of the account | +| `LogonType` | string | Type of logon session, specifically:

- **Interactive** - User physically interacts with the machine using the local keyboard and screen

- **Remote interactive (RDP) logons** - User interacts with the machine remotely using Remote Desktop, Terminal Services, Remote Assistance, or other RDP clients

- **Network** - Session initiated when the machine is accessed using PsExec or when shared resources on the machine, such as printers and shared folders, are accessed

- **Batch** - Session initiated by scheduled tasks

- **Service** - Session initiated by services as they start
| +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name or a host name without domain information | +| `RemoteIP` | string | IP address that was being connected to | +| `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| `RemotePort` | int | TCP port on the remote device that was being connected to | +| `AdditionalFields` | string | Additional information about the event in JSON array format | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `IsLocalAdmin` | boolean | Boolean indicator of whether the user is a local administrator on the machine | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md index 581b173d15..0fe9b537f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceNetworkEvents table in the Advanced hunting schema -description: Learn about network connection events you can query from the DeviceNetworkEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip +title: DeviceNetworkEvents table in the advanced hunting schema +description: Learn about network connection events you can query from the DeviceNetworkEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, devicenetworkevents, network connection, remote ip, local ip, NetworkCommunicationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,41 +26,41 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceNetworkEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. +The `DeviceNetworkEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| RemoteIP | string | IP address that was being connected to | -| RemotePort | int | TCP port on the remote device that was being connected to | -| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to | -| LocalIP | string | IP address assigned to the local machine used during communication | -| LocalPort | int | TCP port on the local machine used during communication | -| Protocol | string | IP protocol used, whether TCP or UDP | -| LocalIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| RemoteIPType | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `RemoteIP` | string | IP address that was being connected to | +| `RemotePort` | int | TCP port on the remote device that was being connected to | +| `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | +| `LocalIP` | string | IP address assigned to the local machine used during communication | +| `LocalPort` | int | TCP port on the local machine used during communication | +| `Protocol` | string | IP protocol used, whether TCP or UDP | +| `LocalIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| `RemoteIPType` | string | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md index 66f0663d23..e202a842bc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md @@ -1,7 +1,7 @@ --- -title: DeviceNetworkInfo table in the Advanced hunting schema -description: Learn about network configuration information in the DeviceNetworkInfo table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel +title: DeviceNetworkInfo table in the advanced hunting schema +description: Learn about network configuration information in the DeviceNetworkInfo table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, devicenetworkinfo, device, machine, mac, ip, adapter, dns, dhcp, gateway, tunnel, MachineNetworkInfo search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,27 +26,27 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceNetworkInfo table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. +The `DeviceNetworkInfo` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| NetworkAdapterName | string | Name of the network adapter | -| MacAddress | string | MAC address of the network adapter | -| NetworkAdapterType | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | -| NetworkAdapterStatus | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) | -| TunnelType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH | -| ConnectedNetworks | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet | -| DnsAddresses | string | DNS server addresses in JSON array format | -| IPv4Dhcp | string | IPv4 address of DHCP server | -| IPv6Dhcp | string | IPv6 address of DHCP server | -| DefaultGateways | string | Default gateway addresses in JSON array format | -| IPAddresses | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `NetworkAdapterName` | string | Name of the network adapter | +| `MacAddress` | string | MAC address of the network adapter | +| `NetworkAdapterType` | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) | +| `NetworkAdapterStatus` | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) | +| `TunnelType` | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH | +| `ConnectedNetworks` | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet | +| `DnsAddresses` | string | DNS server addresses in JSON array format | +| `IPv4Dhcp` | string | IPv4 address of DHCP server | +| `IPv6Dhcp` | string | IPv6 address of DHCP server | +| `DefaultGateways` | string | Default gateway addresses in JSON array format | +| `IPAddresses` | string | JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and IP address space, such as public, private, or link-local | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md index 42ed9a3829..71177a6205 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceProcessEvents table in the Advanced hunting schema -description: Learn about the process spawning or creation events in the DeviceProcessEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line +title: DeviceProcessEvents table in the advanced hunting schema +description: Learn about the process spawning or creation events in the DeviceProcessEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceprocessevents, process id, command line, ProcessCreationEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,49 +26,49 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceProcessEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. +The `DeviceProcessEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| FileName | string | Name of the file that the recorded action was applied to | -| FolderPath | string | Folder containing the file that the recorded action was applied to | -| SHA1 | string | SHA-1 of the file that the recorded action was applied to | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. | -| MD5 | string | MD5 hash of the file that the recorded action was applied to | -| ProcessId | int | Process ID (PID) of the newly created process | -| ProcessCommandLine | string | Command line used to create the new process | -| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources | -| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | -| ProcessCreationTime | datetime | Date and time the process was created | -| AccountDomain | string | Domain of the account | -| AccountName | string | User name of the account | -| AccountSid | string | Security Identifier (SID) of the account | -| LogonId | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessLogonId | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessSHA256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `FileName` | string | Name of the file that the recorded action was applied to | +| `FolderPath` | string | Folder containing the file that the recorded action was applied to | +| `SHA1` | string | SHA-1 of the file that the recorded action was applied to | +| `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. | +| `MD5` | string | MD5 hash of the file that the recorded action was applied to | +| `ProcessId` | int | Process ID (PID) of the newly created process | +| `ProcessCommandLine` | string | Command line used to create the new process | +| `ProcessIntegrityLevel` | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources | +| `ProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process | +| `ProcessCreationTime` | datetime | Date and time the process was created | +| `AccountDomain` | string | Domain of the account | +| `AccountName` | string | User name of the account | +| `AccountSid` | string | Security Identifier (SID) of the account | +| `LogonId` | string | Identifier for a logon session. This identifier is unique on the same machine only between restarts | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessLogonId` | string | Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts. | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessSHA256` | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md index fee6397cd2..396feb40c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md @@ -1,7 +1,7 @@ --- -title: DeviceRegistryEvents table in the Advanced hunting schema -description: Learn about registry events you can query from the DeviceRegistryEvents table of the Advanced hunting schema -keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value +title: DeviceRegistryEvents table in the advanced hunting schema +description: Learn about registry events you can query from the DeviceRegistryEvents table of the advanced hunting schema +keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, deviceregistryevents, registry, key, subkey, value, RegistryEvents search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -26,39 +26,39 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The DeviceRegistryEvents table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. +The `DeviceRegistryEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting schema reference](advanced-hunting-schema-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| Timestamp | datetime | Date and time when the event was recorded | -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| ActionType | string | Type of activity that triggered the event | -| RegistryKey | string | Registry key that the recorded action was applied to | -| RegistryValueType | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | -| RegistryValueName | string | Name of the registry value that the recorded action was applied to | -| RegistryValueData | string | Data of the registry value that the recorded action was applied to | -| PreviousRegistryValueName | string | Original name of the registry value before it was modified | -| PreviousRegistryValueData | string | Original data of the registry value before it was modified | -| InitiatingProcessAccountDomain | string | Domain of the account that ran the process responsible for the event | -| InitiatingProcessAccountName | string | User name of the account that ran the process responsible for the event | -| InitiatingProcessAccountSid | string | Security Identifier (SID) of the account that ran the process responsible for the event | -| InitiatingProcessSHA1 | string | SHA-1 of the process (image file) that initiated the event | -| InitiatingProcessMD5 | string | MD5 hash of the process (image file) that initiated the event | -| InitiatingProcessFileName | string | Name of the process that initiated the event | -| InitiatingProcessId | int | Process ID (PID) of the process that initiated the event | -| InitiatingProcessCommandLine | string | Command line used to run the process that initiated the event | -| InitiatingProcessCreationTime | datetime | Date and time when the process that initiated the event was started | -| InitiatingProcessFolderPath | string | Folder containing the process (image file) that initiated the event | -| InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event | -| InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started | -| InitiatingProcessIntegrityLevel | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | -| InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | -| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | -| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | +| `Timestamp` | datetime | Date and time when the event was recorded | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `ActionType` | string | Type of activity that triggered the event | +| `RegistryKey` | string | Registry key that the recorded action was applied to | +| `RegistryValueType` | string | Data type, such as binary or string, of the registry value that the recorded action was applied to | +| `RegistryValueName` | string | Name of the registry value that the recorded action was applied to | +| `RegistryValueData` | string | Data of the registry value that the recorded action was applied to | +| `PreviousRegistryValueName` | string | Original name of the registry value before it was modified | +| `PreviousRegistryValueData` | string | Original data of the registry value before it was modified | +| `InitiatingProcessAccountDomain` | string | Domain of the account that ran the process responsible for the event | +| `InitiatingProcessAccountName` | string | User name of the account that ran the process responsible for the event | +| `InitiatingProcessAccountSid` | string | Security Identifier (SID) of the account that ran the process responsible for the event | +| `InitiatingProcessSHA1` | string | SHA-1 of the process (image file) that initiated the event | +| `InitiatingProcessMD5` | string | MD5 hash of the process (image file) that initiated the event | +| `InitiatingProcessFileName` | string | Name of the process that initiated the event | +| `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | +| `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | +| `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | +| `InitiatingProcessFolderPath` | string | Folder containing the process (image file) that initiated the event | +| `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event | +| `InitiatingProcessParentCreationTime` | datetime | Date and time when the parent of the process responsible for the event was started | +| `InitiatingProcessIntegrityLevel` | string | Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | +| `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md index 33df9bb93f..7211e19c61 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview.md @@ -1,5 +1,5 @@ --- -title: Overview of Advanced hunting +title: Overview of advanced hunting description: Use threat hunting capabilities in Microsoft Defender ATP to build queries that find threats and weaknesses in your network keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto search.product: eADQiWindows 10XVcnh @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# Proactively hunt for threats with Advanced hunting +# Proactively hunt for threats with advanced hunting **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -28,9 +28,9 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t You can use the same threat-hunting queries to build custom detection rules. These rules run automatically to check for and respond to various events and system states, including suspected breach activity and misconfigured machines. -## Get started with Advanced hunting +## Get started with advanced hunting -We recommend going through several steps to quickly get up and running with Advanced hunting. +We recommend going through several steps to quickly get up and running with advanced hunting. | Learning goal | Description | Resource | |--|--|--| @@ -41,7 +41,7 @@ We recommend going through several steps to quickly get up and running with Adva ## Get help as you write queries Take advantage of the following functionality to write queries faster: -- **Autosuggest** — as you write queries, Advanced hunting provides suggestions. +- **Autosuggest** — as you write queries, advanced hunting provides suggestions. - **Schema reference** — a schema reference that includes the list of tables and their columns is provided next to your working area. For more information, hover over an item. Double-click an item to insert it to the query editor. ## Drilldown from query results @@ -54,14 +54,14 @@ Right-click a value in the result set to quickly enhance your query. You can use - Exclude the selected value from the query (`!=`) - Get more advanced operators for adding the value to your query, such as `contains`, `starts with` and `ends with` -![Image of Microsoft Defender ATP Advanced hunting result set](images/atp-advanced-hunting-results-filter.png) +![Image of Microsoft Defender ATP advanced hunting result set](images/atp-advanced-hunting-results-filter.png) ## Filter the query results The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances. Refine your query by selecting the "+" or "-" buttons next to the values that you want to include or exclude. -![Image of Advanced hunting filter](images/atp-filter-advanced-hunting.png) +![Image of advanced hunting filter](images/atp-filter-advanced-hunting.png) Once you apply the filter to modify the query and then run the query, the results are updated accordingly. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md index 33817ad10f..0b30e86cd8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language.md @@ -1,6 +1,6 @@ --- -title: Learn the Advanced hunting query language -description: Create your first threat hunting query and learn about common operators and other aspects of the Advanced hunting query language +title: Learn the advanced hunting query language +description: Create your first threat hunting query and learn about common operators and other aspects of the advanced hunting query language keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, language, learn, first query, telemetry, events, telemetry, custom detections, schema, kusto, operators, data types search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,14 +18,14 @@ ms.topic: article ms.date: 10/08/2019 --- -# Learn the Advanced hunting query language +# Learn the advanced hunting query language **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) > Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink) -Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for Advanced hunting. To understand these concepts better, run your first query. +Advanced hunting is based on the [Kusto query language](https://docs.microsoft.com/azure/kusto/query/). You can use Kusto syntax and operators to construct queries that locate information in the [schema](advanced-hunting-schema-reference.md) specifically structured for advanced hunting. To understand these concepts better, run your first query. ## Try your first query @@ -45,9 +45,9 @@ DeviceProcessEvents | top 100 by Timestamp ``` -This is how it will look like in Advanced hunting. +This is how it will look like in advanced hunting. -![Image of Microsoft Defender ATP Advanced hunting query](images/advanced-hunting-query-example.png) +![Image of Microsoft Defender ATP advanced hunting query](images/advanced-hunting-query-example.png) ### Describe the query and specify the table to search The query starts with a short comment describing what it is for. This helps if you later decide to save your query and share it with others in your organization. @@ -91,9 +91,9 @@ Now that your query clearly identifies the data you want to locate, you can add Click **Run query** to see the results. You can expand the screen view so you can focus on your hunting query and the results. -## Learn common query operators for Advanced hunting +## Learn common query operators for advanced hunting -Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by Advanced hunting supports a range of operators, including the following common ones. +Now that you've run your first query and have a general idea of its components, it's time to backtrack a little bit and learn some basics. The Kusto query language used by advanced hunting supports a range of operators, including the following common ones. | Operator | Description and usage | |--|--| @@ -108,11 +108,11 @@ Now that you've run your first query and have a general idea of its components, | **makeset** | Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group. | | **find** | Find rows that match a predicate across a set of tables. | -To see a live example of these operators, run them from the **Get started** section of the Advanced hunting page. +To see a live example of these operators, run them from the **Get started** section of the advanced hunting page. ## Understand data types -Data in Advanced hunting tables are generally classified into the following data types. +Data in advanced hunting tables are generally classified into the following data types. | Data type | Description and query implications | |--|--| @@ -126,7 +126,7 @@ Data in Advanced hunting tables are generally classified into the following data The **Get started** section provides a few simple queries using commonly used operators. Try running these queries and making small modifications to them. -![Image of Advanced hunting window](images/atp-advanced-hunting.png) +![Image of advanced hunting window](images/atp-advanced-hunting.png) > [!NOTE] > Apart from the basic query samples, you can also access [shared queries](advanced-hunting-shared-queries.md) for specific threat hunting scenarios. Explore the shared queries on the left side of the page or the GitHub query repository. diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index ad7829bfa9..8fd07c3b19 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -1,6 +1,6 @@ --- -title: Advanced hunting schema reference -description: Learn about the tables in the Advanced hunting schema to understand the data you can run threat hunting queries on +title: advanced hunting schema reference +description: Learn about the tables in the advanced hunting schema to understand the data you can run threat hunting queries on keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, data search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# Understand the Advanced hunting schema +# Understand the advanced hunting schema **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -27,13 +27,13 @@ ms.date: 10/08/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the Advanced hunting schema. +The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema. ## Schema tables -The following reference lists all the tables in the Advanced hunting schema. Each table name links to a page describing the column names for that table. +The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table. -Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the Advanced hunting screen. +Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the advanced hunting screen. | Table name | Description | |------------|-------------| @@ -47,10 +47,10 @@ Table and column names are also listed within the Microsoft Defender Security Ce | **[DeviceLogonEvents](advanced-hunting-devicelogonevents-table.md)** | Sign-ins and other authentication events | | **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events | | **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection | -| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Vulnerabilities in your software inventory | -| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Publicly-available vulnerabilities and whether they exist in your software inventory | -| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Security configuration assessment information | -| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Basis of security configuration assessment such as security industry standards and benchmarks | +| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products | +| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available | +| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices | +| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks | ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md index d32a485fd7..c086fd1418 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-shared-queries.md @@ -1,5 +1,5 @@ --- -title: Use shared queries in Advanced hunting +title: Use shared queries in advanced hunting description: Start threat hunting immediately with predefined and shared queries. Share your queries to the public or to your organization. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, custom detections, schema, kusto, github repo, my queries, shared queries search.product: eADQiWindows 10XVcnh @@ -18,7 +18,7 @@ ms.topic: article ms.date: 10/08/2019 --- -# Use shared queries in Advanced hunting +# Use shared queries in advanced hunting **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -54,10 +54,10 @@ You can save a new or existing query so that it is only accessible to you or sha 2. Select **Delete** and confirm deletion. Or select **Rename** and provide a new name for the query. ## Access queries in the GitHub repository -Microsoft security researchers regularly share Advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). +Microsoft security researchers regularly share advanced hunting queries in a [designated public repository on GitHub](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). This repository is open to contributions. To contribute, [join GitHub for free](https://github.com/). >[!TIP] ->Microsoft security researchers also provide Advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](threat-analytics.md) reports in Microsoft Defender Security Center. +>Microsoft security researchers also provide advanced hunting queries that you can use to locate activities and indicators associated with emerging threats. These queries are provided as part of the [threat analytics](threat-analytics.md) reports in Microsoft Defender Security Center. ## Related topics - [Advanced hunting overview](advanced-hunting-overview.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md index 3fd747d1c7..ba92db654a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema -description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the Advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information. +title: DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema +description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,21 +28,21 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant. +Each row in the `DeviceTvmSecureConfigurationAssessment` table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| -| Timestamp | datetime |Date and time when the record was generated | -| ConfigurationId | string | Unique identifier for a specific configuration | -| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls | -| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | -| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) | -| IsCompliant | boolean | Indicates whether the configuration or policy is properly configured | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.| +| `Timestamp` | datetime |Date and time when the record was generated | +| `ConfigurationId` | string | Unique identifier for a specific configuration | +| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls | +| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | +| `IsCompliant` | boolean | Indicates whether the configuration or policy is properly configured | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md index 5da1e8e986..9ea78ad918 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema -description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the Advanced hunting schema. +title: DeviceTvmSecureConfigurationAssessmentKB table in the advanced hunting schema +description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the advanced hunting schema. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,22 +28,22 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table. +The `DeviceTvmSecureConfigurationAssessmentKB` table in the advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| ConfigurationId | string | Unique identifier for a specific configuration | -| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) | -| ConfigurationName | string | Display name of the configuration | -| ConfigurationDescription | string | Description of the configuration | -| RiskDescription | string | Description of the associated risk | -| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| -| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | -| ConfigurationBenchmarks | string | List of industry benchmarks recommending the same or similar configuration | -| RelatedMitreTechniques | string | List of Mitre ATT&CK framework techniques related to the configuration | -| RelatedMitreTactics | string | List of Mitre ATT&CK framework tactics related to the configuration | +| `ConfigurationId` | string | Unique identifier for a specific configuration | +| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) | +| `ConfigurationName` | string | Display name of the configuration | +| `ConfigurationDescription` | string | Description of the configuration | +| `RiskDescription` | string | Description of the associated risk | +| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls| +| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. | +| `ConfigurationBenchmarks` | string | List of industry benchmarks recommending the same or similar configuration | +| `RelatedMitreTechniques` | string | List of Mitre ATT&CK framework techniques related to the configuration | +| `RelatedMitreTactics ` | string | List of Mitre ATT&CK framework tactics related to the configuration | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md index 63fa5e1590..ff9eac991d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema -description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the Advanced hunting schema. +title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema +description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -29,22 +29,22 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table. +The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| DeviceId | string | Unique identifier for the machine in the service | -| DeviceName | string | Fully qualified domain name (FQDN) of the machine | -| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | -| OSVersion | string | Version of the operating system running on the machine | -| OSArchitecture | string | Architecture of the operating system running on the machine | -| SoftwareVendor | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | -| SoftwareName | string | Name of the software product | -| SoftwareVersion | string | Version number of the software product | -| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | -| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | +| `DeviceId` | string | Unique identifier for the machine in the service | +| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine | +| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | +| `OSVersion` | string | Version of the operating system running on the machine | +| `OSArchitecture` | string | Architecture of the operating system running on the machine | +| `SoftwareVendor` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | +| `SoftwareName` | string | Name of the software product | +| `SoftwareVersion` | string | Version number of the software product | +| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | +| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md index 754894ddbf..902684edc0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md @@ -1,6 +1,6 @@ --- -title: DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema -description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the Advanced hunting schema. +title: DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema +description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the advanced hunting schema. keywords: advanced hunting, threat hunting, cyber threat hunting, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,20 +28,20 @@ ms.date: 11/12/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table. +The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table. -For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md). +For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md). | Column name | Data type | Description | |-------------|-----------|-------------| -| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | -| CvssScore | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) | -| IsExploitAvailable | boolean | Indicates whether exploit code for the vulnerability is publicly available | -| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | -| LastModifiedTime | datetime | Date and time the item or related metadata was last modified | -| PublishedDate | datetime | Date vulnerability was disclosed to public | -| VulnerabilityDescription | string | Description of vulnerability and associated risks | -| AffectedSoftware | string | List of all software products affected by the vulnerability | +| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system | +| `CvssScore` | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) | +| `IsExploitAvailable` | boolean | Indicates whether exploit code for the vulnerability is publicly available | +| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape | +| `LastModifiedTime` | datetime | Date and time the item or related metadata was last modified | +| `PublishedDate` | datetime | Date vulnerability was disclosed to public | +| `VulnerabilityDescription` | string | Description of vulnerability and associated risks | +| `AffectedSoftware` | string | List of all software products affected by the vulnerability | ## Related topics diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 84f22f9ef0..e4e202f76f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -46,7 +46,7 @@ For information about configuring attack surface reduction rules, see [Enable at Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. -You can query Microsoft Defender ATP data by using [Advanced hunting](advanced-hunting-query-language.md). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to understand how attack surface reduction rules could affect your environment. +You can query Microsoft Defender ATP data by using [Advanced hunting](advanced-hunting-query-language.md). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to understand how attack surface reduction rules could affect your environment. Here is an example query: diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index 44d145c9e9..ae15f3e5c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -51,7 +51,7 @@ Controlled folder access requires enabling [Windows Defender Antivirus real-time Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. Here is an example query diff --git a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md index 854e4f2e9b..90c461b3d6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md +++ b/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules.md @@ -117,7 +117,7 @@ You can also take the following actions on the rule from this page: - **Run** — run the rule immediately. This also resets the interval for the next run. - **Edit** — modify the rule without changing the query -- **Modify query** — edit the query in Advanced hunting +- **Modify query** — edit the query in advanced hunting - **Turn on** / **Turn off** — enable the rule or stop it from running - **Delete** — turn off the rule and remove it @@ -127,5 +127,5 @@ You can also take the following actions on the rule from this page: ## Related topic - [Custom detections overview](overview-custom-detections.md) - [Advanced hunting overview](advanced-hunting-overview.md) -- [Learn the Advanced hunting query language](advanced-hunting-query-language.md) +- [Learn the advanced hunting query language](advanced-hunting-query-language.md) - [View and organize alerts](alerts-queue.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md index c7ae3aac79..ccab9e8250 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md +++ b/windows/security/threat-protection/microsoft-defender-atp/evaluation-lab.md @@ -152,7 +152,7 @@ You can also use [Advanced hunting](advanced-hunting-query-language.md) to query After running your simulations, we encourage you to walk through the lab progress bar and explore Microsoft Defender ATP features. See if your attacks triggered an automated investigation and remediation, check out the evidence collected and analyzed by the feature. -Hunt for attack evidence through Advanced hunting by using the rich query language and raw telemetry and check out some world-wide threats documented in Threat analytics. +Hunt for attack evidence through advanced hunting by using the rich query language and raw telemetry and check out some world-wide threats documented in Threat analytics. ## Simulation results diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md index 2642c7655d..29df4eb11a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection.md @@ -49,7 +49,7 @@ Many of the features in the [Enhanced Mitigation Experience Toolkit (EMET)](http Microsoft Defender ATP provides detailed reporting into events and blocks as part of its alert investigation scenarios. -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how exploit protection settings could affect your environment. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how exploit protection settings could affect your environment. Here is an example query: diff --git a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md index b1a6786f57..cdcb26b8fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/network-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/network-protection.md @@ -52,7 +52,7 @@ Windows 10 version 1709 or later | [Windows Defender AV real-time protection](.. Microsoft Defender ATP provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use Advanced hunting to see how network protection settings would affect your environment if they were enabled. +You can query Microsoft Defender ATP data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how network protection settings would affect your environment if they were enabled. Here is an example query diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md index 03e0f5ca62..470e593502 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md @@ -1,7 +1,7 @@ --- title: Overview of custom detections in Microsoft Defender ATP ms.reviewer: -description: Understand how you can use Advanced hunting to create custom detections and generate alerts +description: Understand how you can use advanced hunting to create custom detections and generate alerts keywords: custom detections, alerts, detection rules, advanced hunting, hunt, query, response actions, interval, mdatp, microsoft defender atp search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -28,7 +28,7 @@ With custom detections, you can proactively monitor for and respond to various e Custom detections work with [Advanced hunting](advanced-hunting-overview.md), which provides a powerful, flexible query language that covers a broad set of event and system information from your network. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches. Custom detections provide: -- Alerts for rule-based detections built from Advanced hunting queries +- Alerts for rule-based detections built from advanced hunting queries - Automatic response actions that apply to files and machines >[!NOTE] diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 07e1d96848..a092af970c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -46,7 +46,7 @@ The following features are included in the preview release: - [Threat & Vulnerability Management Report inaccuracy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy)
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated [security recommendation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation#report-inaccuracy), [software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory#report-inaccuracy), and [discovered vulnerabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses#report-inaccuracy). -- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table)
You can now use the Threat & Vulnerability Management tables in the Advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. +- [Threat & Vulnerability Management Advanced Hunting Schemas](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table)
You can now use the Threat & Vulnerability Management tables in the advanced hunting schema to query about software inventory, vulnerability knowledgebase, security configuration assessment, and security configuration knowledgebase. - [Threat & Vulnerability Management role-based access controls](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
You can now use the new permissions to allow maximum flexibility to create SecOps-oriented roles, Threat & Vulnerability Management-oriented roles, or hybrid roles so only authorized users are accessing specific data to do their task. You can also achieve even further granularity by specifying whether a Threat & Vulnerability Management role can only view vulnerability-related data, or can create and manage remediation and exceptions. diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 93c0a3388e..df23634446 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -159,7 +159,7 @@ When an exception is created for a recommendation, the recommendation is no long 6. Navigate to the **Remediation** page under the **Threat & Vulnerability Management** menu and click the **Exceptions** tab to view all your exceptions (current and past). ![Screenshot of exception list of exceptions in the Remediation page](images/tvm-exception-list.png) -## Use Advanced hunting query to search for machines with High active alerts or critical CVE public exploit +## Use advanced hunting query to search for machines with High active alerts or critical CVE public exploit 1. Go to **Advanced hunting** from the left-hand navigation pane. @@ -193,5 +193,5 @@ DeviceName=any(DeviceName) by DeviceId, AlertId - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) - [Advanced hunting overview](overview-hunting.md) -- [All Advanced hunting tables](advanced-hunting-reference.md) +- [All advanced hunting tables](advanced-hunting-reference.md) - [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group) diff --git a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md index 7e542c0b65..252b58265c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md @@ -94,7 +94,7 @@ For more information preview features, see [Preview features](https://docs.micro - [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard)
Controlled folder access is now supported on Windows Server 2019. -- [Custom detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-custom-detections)
With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of Advanced hunting through the creation of custom detection rules. +- [Custom detection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-custom-detections)
With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats. This can be done by leveraging the power of advanced hunting through the creation of custom detection rules. - [Integration with Azure Security Center](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection#integration-with-azure-security-center)
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers. @@ -120,7 +120,7 @@ Threat Analytics is a set of interactive reports published by the Microsoft Defe ## March 2018 - [Advanced Hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)
-Query data using Advanced hunting in Microsoft Defender ATP. +Query data using advanced hunting in Microsoft Defender ATP. - [Attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
New attack surface reduction rules: From 77cc958b52c111ac61437809b95a66ec90b80b9d Mon Sep 17 00:00:00 2001 From: lomayor Date: Mon, 6 Jan 2020 18:13:00 -0800 Subject: [PATCH 6/7] Fixed table rendering --- .../advanced-hunting-deviceevents-table.md | 4 ++-- .../advanced-hunting-devicefileevents-table.md | 4 ++-- .../advanced-hunting-deviceimageloadevents-table.md | 2 +- .../advanced-hunting-deviceinfo-table.md | 2 +- .../advanced-hunting-devicelogonevents-table.md | 2 +- .../advanced-hunting-devicenetworkevents-table.md | 2 +- .../advanced-hunting-devicenetworkinfo-table.md | 2 +- .../advanced-hunting-deviceprocessevents-table.md | 2 +- .../advanced-hunting-deviceregistryevents-table.md | 2 +- .../advanced-hunting-schema-reference.md | 2 +- 10 files changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md index aed7f010df..9134afc574 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The miscellaneous device events or `DeviceEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. +The miscellaneous device events or `DeviceEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about various event types, including events triggered by security controls, such as Windows Defender Antivirus and exploit protection. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). @@ -42,7 +42,7 @@ For information on other tables in the advanced hunting schema, see [the advance | `SHA256` | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available | | `MD5` | string | MD5 hash of the file that the recorded action was applied to | | `AccountDomain` | string | Domain of the account | -| `AccountName |string | User name of the account | +| `AccountName` |string | User name of the account | | `AccountSid` | string | Security Identifier (SID) of the account | | `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | | `RemoteDeviceName` | string | Name of the machine that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 7e519fa914..221f3433e8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceFileEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. +The `DeviceFileEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about file creation, modification, and other file system events. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). @@ -66,7 +66,7 @@ For information on other tables in the advanced hunting schema, see [the advanc | `RequestAccountName` | string | User name of account used to remotely initiate the activity | | `RequestAccountDomain` | string | Domain of the account used to remotely initiate the activity | | `RequestAccountSid` | string | Security Identifier (SID) of the account to remotely initiate the activity | -| `ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | +| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns | | `AppGuardContainerId` | string | Identifier for the virtualized container used by Application Guard to isolate browser activity | | `SensitivityLabel` | string | Label applied to an email, file, or other content to classify it for information protection | | `SensitivitySubLabel` | string | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently | diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md index e8acfd67d4..d57a965bcf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceImageLoadEvents table` in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. +The `DeviceImageLoadEvents table` in the [advanced hunting](advanced-hunting-overview.md) schema contains information about DLL loading events. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md index 16a90f67ad..f05d8d0382 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceInfo` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. +The `DeviceInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about machines in the organization, including their OS version, active users, and computer name. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md index 8177e49c74..689d68d6e6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceLogonEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. +The `DeviceLogonEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user logons and other authentication events. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md index 0fe9b537f7..fb91c21fd2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceNetworkEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. +The `DeviceNetworkEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about network connections and related events. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md index e202a842bc..ba7cf147bf 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceNetworkInfo` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. +The `DeviceNetworkInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about networking configuration of machines, including network adapters, IP and MAC addresses, and connected networks or domains. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md index 71177a6205..7b656947ec 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceProcessEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. +The `DeviceProcessEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about process creation and related events. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md index 396feb40c0..8dfc835e93 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md @@ -26,7 +26,7 @@ ms.date: 10/08/2019 >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink) -The `DeviceRegistryEvents` table in the [Advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. +The `DeviceRegistryEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about the creation and modification of registry entries. Use this reference to construct queries that return information from the table. For information on other tables in the advanced hunting schema, see [the advanced hunting schema reference](advanced-hunting-schema-reference.md). diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md index e4367e6079..7c64003218 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md @@ -27,7 +27,7 @@ ms.date: 10/08/2019 [!include[Prerelease information](../../includes/prerelease.md)] -The [Advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema. +The [advanced hunting](advanced-hunting-overview.md) schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema. ## Schema tables From bab0cd447a9b30757831eb0e5ecb9498dd5f7b0d Mon Sep 17 00:00:00 2001 From: lomayor Date: Mon, 6 Jan 2020 18:25:06 -0800 Subject: [PATCH 7/7] Update advanced-hunting-devicefileevents-table.md --- .../advanced-hunting-devicefileevents-table.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md index 221f3433e8..82bc19d642 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table.md @@ -54,7 +54,7 @@ For information on other tables in the advanced hunting schema, see [the advanc | `InitiatingProcessId` | int | Process ID (PID) of the process that initiated the event | | `InitiatingProcessCommandLine` | string | Command line used to run the process that initiated the event | | `InitiatingProcessCreationTime` | datetime | Date and time when the process that initiated the event was started | -| `InitiatingProcessIntegrityLevel` | string` | integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | +| `InitiatingProcessIntegrityLevel` | string | integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources | | `InitiatingProcessTokenElevation` | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event | | `InitiatingProcessParentId` | int | Process ID (PID) of the parent process that spawned the process responsible for the event | | `InitiatingProcessParentFileName` | string | Name of the parent process that spawned the process responsible for the event |