From 15c2d08f65d49ee85968f17829fad3befd576c64 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Thu, 30 Jul 2020 11:22:51 -0700 Subject: [PATCH] Update advanced-hunting-devicealertevents-table.md --- .../advanced-hunting-devicealertevents-table.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md index d568ae26bb..cad9c6214b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table.md @@ -43,6 +43,7 @@ For information on other tables in the advanced hunting schema, see [the advance | `SHA1` | string | SHA-1 of the file that the recorded action was applied to | | `RemoteUrl` | string | URL or fully qualified domain name (FQDN) that was being connected to | | `RemoteIP` | string | IP address that was being connected to | +| `AttackTechniques` | string | MITRE ATT&CK techniques associated with the activity that triggered the alert | | `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns | | `Table` | string | Table that contains the details of the event |