mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 14:27:22 +00:00
Added TVM adv huntng tables
This commit is contained in:
Dulce Montemayor
GitHub
parent
efb0905649
commit
f9bc093384
@ -0,0 +1,51 @@
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema
|
||||
description: Learn about the DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema, such as machine ID, computer name, operating system platform, security configuration details, impact, and compliance information.
|
||||
keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query security configuration, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSecureConfigurationAssessment
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/27/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessment
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The DeviceTvmSecureConfigurationAssessment table in the Advanced hunting schema contains the variables needed in searching for security configuration assessment for devices. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system|
|
||||
| Timestamp | datetime |Date and time when the record was generated|
|
||||
| ConfigurationId | string | Unique identifier for a specific configuration |
|
||||
| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
|
||||
| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| IsCompliant | string | Indicates whether the configuration or policy is properly configured |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](overview-hunting.md)
|
||||
- [All Advanced hunting tables](advanced-hunting-reference.md)
|
||||
- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
|
||||
- [Query data using Advanced hunting](advanced-hunting.md)
|
||||
@ -0,0 +1,51 @@
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema
|
||||
description: Learn about the DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema, security configuration details, and the associated industry benchmarks that it adheres to.
|
||||
keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query security configuration, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, MITRE ATT&CK framework, DeviceTvmSecureConfigurationAssessmentKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/27/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessmentKB
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The DeviceTvmSecureConfigurationAssessmentKB table in the Advanced hunting schema contains the variables needed in searching for your device security configuration information along with the associated security industry benchmarks it adheres to. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| ConfigurationId | string | Unique identifier for a specific configuration |
|
||||
| ConfigurationImpact | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| ConfigurationName | string | Display name of the configuration |
|
||||
| ConfigurationDescription | string | Description of the configuration |
|
||||
| RiskDescription | string | Description of the associated risk |
|
||||
| ConfigurationCategory | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
|
||||
| ConfigurationSubcategory | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| ConfigurationBenchmarks | string | List of industry benchmarks recommending the same or similar configuration |
|
||||
| RelatedMitreTechniques | string | List of Mitre ATT&CK framework techniques observed |
|
||||
| RelatedMitreTactics | string | List of Mitre ATT&CK framework tactics observed |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](overview-hunting.md)
|
||||
- [All Advanced hunting tables](advanced-hunting-reference.md)
|
||||
- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
|
||||
- [Query data using Advanced hunting](advanced-hunting.md)
|
||||
@ -0,0 +1,56 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema
|
||||
description: Learn about the DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema, such as operating system platform, version, and architecture, software vendor, name, and version, CVE ID, vulnerability severity, and descriptions
|
||||
keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query software inventory, query software vulnerability inventory, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSoftwareInventoryVulnerabilities
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/27/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareInventoryVulnerabilities
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains information needed in searching for vulnerabilities in your software inventory. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| MachineId | string | Unique identifier for the machine in the service |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|
|
||||
| OSVersion | string | Version of the operating system running on the machine |
|
||||
| OSArchitecture | string | Architecture of the operating system running on the machine|
|
||||
| SoftwareVendor | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape|
|
||||
| SoftwareName | string | Name of the software product|
|
||||
|SoftwareVersion | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system|
|
||||
| CveId | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape|
|
||||
| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape|
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](overview-hunting.md)
|
||||
- [All Advanced hunting tables](advanced-hunting-reference.md)
|
||||
- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
|
||||
- [Query data using Advanced hunting](advanced-hunting.md)
|
||||
@ -0,0 +1,49 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema
|
||||
description: Learn about the DeviceTvmSoftwareVulnerabilitiesKB table in the Advanced hunting schema, such as CVE ID, CVSS score, exploit availability, vulnerability severity, last modified time, date the vulnerability was disclosed to public, and affected software in your network.
|
||||
keywords: advanced hunting, atp query, device management, query atp data, query tvm data, query software vulnerability inventory, intellisense, atp telemetry, events, events telemetry, azure log analytics, description, DeviceTvmSoftwareVulnerabilitiesKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 10/27/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareVulnerabilitiesKB
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
The DeviceTvmSoftwareInventoryVulnerabilities table in the Advanced hunting schema contains information needed in searching for information about publicly available vulnerabilities and whether they exist in your software inventory. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the Advanced hunting schema, see [the Advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| CveId | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system|
|
||||
| CvssScore | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS)|
|
||||
| IsExploitAvailable | string | Indicates whether exploit code for the vulnerability is publicly available|
|
||||
| VulnerabilitySeverityLevel | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape|
|
||||
| LastModifiedTime | datetime | Date and time the item or related metadata was last modified|
|
||||
| PublishedDate | datetime | Date vulnerability was disclosed to public|
|
||||
| VulnerabilityDescription | string | Description of vulnerability and associated risks|
|
||||
| AffectedSoftware | string | List of all software products affected by the vulnerability|
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](overview-hunting.md)
|
||||
- [All Advanced hunting tables](advanced-hunting-reference.md)
|
||||
- [Advanced hunting query best practices](advanced-hunting-best-practices.md)
|
||||
- [Query data using Advanced hunting](advanced-hunting.md)
|
||||
Loading…
x
Reference in New Issue
Block a user