windows-itpro-docs/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference.md

title, description, keywords, search.product, search.appverid, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.author, author, ms.localizationpriority, manager, audience, ms.collection, ms.topic, ms.date

title	description	keywords	search.product	search.appverid	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	ms.author	author	ms.localizationpriority	manager	audience	ms.collection	ms.topic	ms.date
Advanced hunting schema reference	Learn about the tables in the advanced hunting schema to understand the data you can run threat hunting queries on	advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, data	eADQiWindows 10XVcnh	met150	w10	deploy	library	security	lomayor	lomayor	medium	dansimp	ITPro	M365-security-compliance	article	01/14/2020

Understand the advanced hunting schema

Applies to:

• Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

Want to experience Microsoft Defender ATP? Sign up for a free trial.

[!includePrerelease information]

The advanced hunting schema is made up of multiple tables that provide either event information or information about machines and other entities. To effectively build queries that span multiple tables, you need to understand the tables and the columns in the advanced hunting schema.

Schema tables

The following reference lists all the tables in the advanced hunting schema. Each table name links to a page describing the column names for that table.

Table and column names are also listed within the Microsoft Defender Security Center, in the schema representation on the advanced hunting screen.

Table name	Description
DeviceAlertEvents	Alerts on Microsoft Defender Security Center
DeviceInfo	Machine information, including OS information
DeviceNetworkInfo	Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains
DeviceProcessEvents	Process creation and related events
DeviceNetworkEvents	Network connection and related events
DeviceFileEvents	File creation, modification, and other file system events
DeviceRegistryEvents	Creation and modification of registry entries
DeviceLogonEvents	Sign-ins and other authentication events
DeviceImageLoadEvents	DLL loading events
DeviceEvents	Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection
DeviceFileCertificateInfo	Certificate information of signed files obtained from certificate verification events on endpoints
DeviceTvmSoftwareInventoryVulnerabilities	Inventory of software on devices as well as any known vulnerabilities in these software products
DeviceTvmSoftwareVulnerabilitiesKB	Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available
DeviceTvmSecureConfigurationAssessment	Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices
DeviceTvmSecureConfigurationAssessmentKB	Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks

Related topics

• Advanced hunting overview
• Work with query results
• Learn the query language