AADSignInEventsBeta / EntraidSignInEvents
Microsoft Entra interactive and non-interactive sign-ins
AADSpnSignInEventsBeta / EntraidSpnSignInEvents
Microsoft Entra service principal and managed identity sign-ins
differences between EntraidSignInEvents and EntraidSpnSignInEvents
EntraIdSignInEvents-
Monitoring and troubleshooting user authentication, including MFA, device info, and conditional access policies.
EntraIdSpnSignInEvents-
Monitoring and troubleshooting application authentication, service-to-service communication, and non-interactive processes.
AlertEvidence
Files, IP addresses, URLs, users, or devices associated with alerts
AlertInfo
Alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity, including severity information and threat categorization
AlertEvidence vs AlertInfo
AlertInfo to get a list of alerts and overview of alert.
AlertEvidence for more granual information on the alert.
BehaviorEntities
Behavior data types in Microsoft Defender for Cloud Apps (not available for GCC)
The BehaviorEntities table in the Microsoft Defender XDR advanced hunting schema contains detailed information about the specific entities (users, devices, files, IP addresses, etc.) involved in an identified behavior.
Behaviors are an abstract data layer, sourced primarily from Microsoft Defender for Cloud Apps, that provide contextual insight into events, bridging the gap between raw event data and full-blown security alerts.
BehaviorInfo
Alerts from Microsoft Defender for Cloud Apps (not available for GCC)
CloudAppEvents
Events involving accounts and objects in Office 365 and other cloud apps and services
CloudAuditEvents
Cloud audit events for various cloud platforms protected by the organization’s Microsoft Defender for Cloud
CloudAppEvents vs CloudAuditEvents
CloudAppEvents
Events involving accounts and objects in Office 365 and other connected third-party cloud apps (like Dropbox, Box, AWS, Azure, GCP user activities).
CloudAuditEvents
Cloud audit events for various cloud platforms, with a strong focus on infrastructure and resource management operations (e.g., Azure Resource Manager operations, Kubernetes API calls).
Use the CloudAppEvents table to hunt for activities related to what users are doing within specific cloud applications (e.g., “Who downloaded this file from SharePoint?”).
Use the CloudAuditEvents table to hunt for activities related to how your cloud infrastructure is being managed or accessed (e.g., “Was a suspicious operation performed on an Azure resource group?” or “Were any unusual Kubernetes API calls made?”).
CloudProcessEvents
Cloud process events for various cloud platforms protected by the organization’s Microsoft Defender for Containers
This table is populated by data collected through Microsoft Defender for Cloud and provides crucial visibility into the runtime environment of services like Azure Kubernetes Service (AKS), Amazon Elastic Kubernetes Service (EKS), and Google Kubernetes Engine (GKE).
CloudStorageAggregatedEvents
Cloud storage activity and related events
DataSecurityBehaviors
Insights about potentially suspicious user behaviors that violate user-defined or default policies configured in the Microsoft Purview suite of solutions
contains insights about potentially suspicious user behaviors that violate the user-defined or default policies configured in the Microsoft Purview suite of solutions.
Insights cover a range of data security related behaviors like behaviors involving exfiltration, obfuscation, risky interactions with AI applications, and others. Insights are generated by aggregating user behaviors over a calendar day and comparing them with previous activity, peer group activity, or other activities done by the user. Insights also capture summaries of various risk pivots like sensitive data, risky destinations, and the like.
This advanced hunting table is populated by records from Microsoft Purview Insider Risk Management.
DataSecurityEvents
Information about user activities that violate user-defined or default policies in the Microsoft Purview suite of solutions
Each log represents a single user activity enriched with proprietary Microsoft detections (like sensitive info types) and user-defined enrichment labels like domain categories, sensitivity labels, and others.
This advanced hunting table is populated by records from Microsoft Purview Insider Risk Management.
DataSecurityBehaviors vs DataSecurityEvents
DataSecurityEvents gives you the “forest” of individual data points you can filter and analyze to pinpoint exact actions.
DataSecurityBehaviors provides a summary “tree” of user activities, highlighting patterns and anomalies flagged by Microsoft Purview’s machine learning, making it easier to spot potential insider threats without processing massive amounts of raw data.
DeviceBaselineComplianceAssessment
Baseline compliance assessment snapshot, which indicates the status of various security configurations related to baseline profiles on devices
DeviceBaselineComplianceAssessmentKB
Information about various security configurations used by baseline compliance to assess devices
DeviceBaselineComplianceProfiles
Baseline profiles used for monitoring device baseline compliance
DeviceBaselineComplianceProfiles vs DeviceBaselineComplianceAssessmentKB vs DeviceBaselineComplianceAssessment
DeviceBaselineComplianceProfiles
to understand your organization’s specific baseline configurations.
Provides details on the customized baseline profiles that an administrator has created and defined in the organization. Information about how baselines are configured (e.g., profile name, associated OS platform, creation time, exception details).
DeviceBaselineComplianceAssessmentKB
to reference the industry-standard definitions for security settings.
Contains a knowledge base of the general security configurations and recommended values. Details on what the ideal setting should be (e.g., “Minimum password length should be 14”), independent of any specific device or custom profile.
DeviceBaselineComplianceAssessment
to view the actual compliance status of each individual device.
Contains the snapshot of the actual assessment results for each device against the defined profiles. Device-specific compliance status (Compliant, NonCompliant, etc.), the actual current value of a setting on the device, the expected value, and the specific DeviceId.
DeviceEvents
Multiple event types, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection
Endpoint activity, covering network connections, USB events, scheduled tasks, login events, shell commands, and more.
DeviceFileCertificateInfo
Certificate information of signed files obtained from certificate verification events on endpoints
DeviceFileEvents
File creation, modification, and other file system events
DeviceImageLoadEvents
DLL loading events
