deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 22:37:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merged PR 13052: Updated info on Advanced Hunting tables

Browse Source 
Added info about MachineNetworkInfo table and updated descriptions of other tables.
This commit is contained in:
Louie Mayor 2018-11-28 23:52:32 +00:00
parent 88698a7493
commit ff8dd459d0
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md
View File

@ -65,15 +65,16 @@ For more information on the query language and supported operators, see [Query L
The following tables are exposed as part of Advanced hunting: The following tables are exposed as part of Advanced hunting:
- **AlertEvents** - Stores alerts related information - **AlertEvents** - Alerts on Windows Defender Security Center
- **MachineInfo** - Stores machines properties - **MachineInfo** - Machine information, including OS information
- **ProcessCreationEvents** - Stores process creation events - **MachineNetworkInfo** - Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains
- **NetworkCommunicationEvents** - Stores network communication events - **ProcessCreationEvents** - Process creation and related events
- **FileCreationEvents** - Stores file creation, modification, and rename events - **NetworkCommunicationEvents** - Network connection and related events
- **RegistryEvents** - Stores registry key creation, modification, rename and deletion events - **FileCreationEvents** - File creation, modification, and other file system events
- **LogonEvents** - Stores login events - **RegistryEvents** - Creation and modification of registry entries
- **ImageLoadEvents** - Stores load dll events - **LogonEvents** - Login and other authentication events
- **MiscEvents** - Stores several types of events, process injection events, access to LSASS processes, and others. - **ImageLoadEvents** - DLL loading events
- **MiscEvents** - Multiple event types, such as process injection, creation of scheduled tasks, and LSASS access attempts
These tables include data from the last 30 days. These tables include data from the last 30 days.