Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

Submit an example for AdditionalFields

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Action EntityType

`AdditionalFields`

Action: 9f651690-6443-3ed3-5f3a-ad38332d9c3f · EntityType: Ip

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "Address": "VALUE_1",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000001",
  "Role": 1,
  "Roles": [
    "VALUE_2"
  ],
  "Type": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 9f651690-6443-3ed3-5f3a-ad38332d9c3f · EntityType: User

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000002",
  "IsDomainJoined": false,
  "Name": "USERNAME_1",
  "Role": 1,
  "Roles": [
    "VALUE_1"
  ],
  "Type": "VALUE_2",
  "UPNSuffix": "VALUE_3",
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.IsDomainJoined`	boolean
`$.Name`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.Upn`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 32f975f8-74a8-0970-44e6-6ec29c958134 · EntityType: User

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000002",
  "IsDomainJoined": false,
  "Name": "USERNAME_1",
  "Role": 1,
  "Roles": [
    "VALUE_1"
  ],
  "Type": "VALUE_2",
  "UPNSuffix": "VALUE_3",
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.IsDomainJoined`	boolean
`$.Name`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.Upn`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: a92140f2-6700-3d7a-a7a0-9519097a1383 · EntityType: Ip

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "Address": "VALUE_1",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000001",
  "Role": 1,
  "Roles": [
    "VALUE_2"
  ],
  "Type": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: e9a82da0-8f67-6bf6-a147-e539299e11b8 · EntityType: User

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000002",
  "IsDomainJoined": false,
  "Name": "USERNAME_1",
  "Role": 1,
  "Roles": [
    "VALUE_1"
  ],
  "Type": "VALUE_2",
  "UPNSuffix": "VALUE_3",
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.IsDomainJoined`	boolean
`$.Name`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.Upn`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 32f975f8-74a8-0970-44e6-6ec29c958134 · EntityType: Ip

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "Address": "VALUE_1",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000001",
  "Role": 1,
  "Roles": [
    "VALUE_2"
  ],
  "Type": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 1f496f27-d55b-6586-9b22-5014576b9a86 · EntityType: Ip

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "Address": "VALUE_1",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000001",
  "Role": 1,
  "Roles": [
    "VALUE_2"
  ],
  "Type": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: e9a82da0-8f67-6bf6-a147-e539299e11b8 · EntityType: Ip

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "Address": "VALUE_1",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000001",
  "Role": 1,
  "Roles": [
    "VALUE_2"
  ],
  "Type": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 24d33246-93fa-1400-716f-5a6a0b7bb6bd · EntityType: CloudApplication

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "AppId": 1,
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000001",
  "Name": "USERNAME_1",
  "RbacScopes": {
    "ScopesPerType": {
      "Mda_AppstanceId": {
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Scopes": [
          "VALUE_1"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_2"
}

Payload fields and types

Path	Type
`$`	object
`$.AppId`	integer
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Mda_AppstanceId`	object
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes`	array
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Type`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 24d33246-93fa-1400-716f-5a6a0b7bb6bd · EntityType: Ip

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "Address": "VALUE_1",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000001",
  "RbacScopes": {
    "ScopesPerType": {
      "Mda_AppstanceId": {
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Scopes": [
          "VALUE_2"
        ]
      }
    }
  },
  "Role": 1,
  "Roles": [
    "VALUE_3"
  ],
  "Type": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.Address`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Mda_AppstanceId`	object
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes`	array
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 24d33246-93fa-1400-716f-5a6a0b7bb6bd · EntityType: User

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "Asset": false,
  "CloudAppAccountId": "00000000-0000-4000-8000-000000000001",
  "HuntingEntityId": "00000000-0000-4000-8000-000000000002",
  "IsDomainJoined": false,
  "Name": "00000000-0000-4000-8000-000000000001",
  "RbacScopes": {
    "ScopesPerType": {
      "Mda_AppstanceId": {
        "Scopes": [
          "1"
        ]
      },
      "Workloads": {
        "Scopes": [
          "VALUE_1"
        ]
      }
    }
  },
  "Role": 1,
  "Type": "VALUE_2",
  "Upn": null
}

Payload fields and types

Path	Type
`$`	object
`$.Asset`	boolean
`$.CloudAppAccountId`	string
`$.HuntingEntityId`	string
`$.IsDomainJoined`	boolean
`$.Name`	string
`$.RbacScopes`	object
`$.RbacScopes.ScopesPerType`	object
`$.RbacScopes.ScopesPerType.Mda_AppstanceId`	object
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes`	array
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]`	encoded-json
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]`	string
`$.RbacScopes.ScopesPerType.Mda_AppstanceId.Scopes[]::<json>`	integer
`$.RbacScopes.ScopesPerType.Workloads`	object
`$.RbacScopes.ScopesPerType.Workloads.Scopes`	array
`$.RbacScopes.ScopesPerType.Workloads.Scopes[]`	string
`$.Role`	integer
`$.Type`	string
`$.Upn`	null
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: 1f496f27-d55b-6586-9b22-5014576b9a86 · EntityType: User

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000002",
  "IsDomainJoined": false,
  "Name": "USERNAME_1",
  "Role": 1,
  "Roles": [
    "VALUE_1"
  ],
  "Type": "VALUE_2",
  "UPNSuffix": "VALUE_3",
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.IsDomainJoined`	boolean
`$.Name`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.Upn`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: a92140f2-6700-3d7a-a7a0-9519097a1383 · EntityType: User

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "$id": "1",
  "AadUserId": "00000000-0000-4000-8000-000000000001",
  "Asset": false,
  "HuntingEntityId": "00000000-0000-4000-8000-000000000002",
  "IsDomainJoined": false,
  "Name": "USERNAME_1",
  "Role": 1,
  "Roles": [
    "VALUE_1"
  ],
  "Type": "VALUE_2",
  "UPNSuffix": "VALUE_3",
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.AadUserId`	string
`$.Asset`	boolean
`$.HuntingEntityId`	string
`$.IsDomainJoined`	boolean
`$.Name`	string
`$.Role`	integer
`$.Roles`	array
`$.Roles[]`	string
`$.Type`	string
`$.UPNSuffix`	string
`$.Upn`	string
`$["$id"]`	encoded-json
`$["$id"]`	string
`$["$id"]::<json>`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

BehaviorEntities Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
AlertsAndObservations	Regular		Contains information about entities (file, process, device, user, and others) that are involved in a behavior	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
_ResourceId	A unique identifier for the resource that the record is associated with	String
_SubscriptionId	A unique identifier for the subscription that the record is associated with	String
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
ActionType	Type of behavior	String
AdditionalFields	Additional information about the behavior	String
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	Int32
BehaviorId	Unique identifier for the behavior	String
Categories	Type of threat indicator or breach activity identified by the behavior	String
CloudPlatform	The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform	String
CloudResource	Cloud resource name	String
CloudResourceId	Unique identifier of the cloud resource accessed.	String
CloudResourceType	Type of cloud resource.	String
CloudSubscriptionId	Unique identifier of the cloud service subscription.	String
DataSources	Products or services that provided information for the behavior	String
DetailedEntityRole	The role of the entity in the behavior	String
DetectionSource	Detection technology or sensor that identified the notable component or activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
EmailClusterId	Identifier for the group of similar emails clustered based on heuristic analysis of their contents	String
EmailSubject	Subject of the email	String
EntityRole	Indicates whether the entity is impacted or merely related	String
EntityType	Type of object, such as a file, a process, a device, or a user	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
LocalIP	IP address assigned to the local machine used during communication	String
MachineGroup		String
NetworkMessageId	Unique identifier for the email, generated by Microsoft 365	String
OAuthApplicationId	Unique identifier of the third-party OAuth application	String
ProcessCommandLine	Command line used to create the new process	String
RegistryKey	Registry key that the recorded action was applied to	String
RegistryValueData	Data of the registry value that the recorded action was applied to	String
RegistryValueName	Name of the registry value that the recorded action was applied to	String
RemoteIP	IP address that was being connected to	String
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ServiceSource	Product or service that identified the behavior	String
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
TenantId		String
ThreatFamily	Malware family that the suspicious or malicious file or process has been classified under	String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Schema changes

Date	Action
2026-10-07	Column _SubscriptionId added
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column CloudResource added
2026-10-07	Column TimeGenerated added
2026-10-07	Column CloudResourceType added
2026-10-07	Column CloudResourceId added
2026-10-07	Column CloudSubscriptionId added
2026-10-07	Column _IsBillable added
2026-10-07	Column _BilledSize added
2026-10-07	Column CloudPlatform added
2026-10-07	Column _ResourceId added
2026-02-27	Column CloudSubscriptionId removed
2026-02-27	Column _SubscriptionId removed
2026-02-27	Column _ResourceId removed
2026-02-27	Column _BilledSize removed
2026-02-27	Column _IsBillable removed
2026-02-27	Column CloudResourceId removed
2026-02-27	Column CloudPlatform removed
2026-02-27	Column CloudResource removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column Type removed
2026-02-27	Column TenantId removed
2026-02-27	Column CloudResourceType removed
2026-02-18	Column CloudResource added
2026-02-18	Column CloudPlatform added
2026-02-18	Column CloudResourceType added
2026-02-18	Column CloudResourceId added
2026-02-18	Column _BilledSize added
2026-02-18	Column _IsBillable added
2026-02-18	Column _ResourceId added
2026-02-18	Column _SubscriptionId added
2026-02-18	Column CloudSubscriptionId added
2026-02-10	Column MachineGroup added
2026-01-02	Table added to tracking

BehaviorEntities Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
AlertsAndObservations	Regular		Contains information about entities (file, process, device, user, and others) that are involved in a behavior	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
_BilledSize		Double
_IsBillable		String
_ResourceId	A unique identifier for the resource that the record is associated with	String
_SubscriptionId	A unique identifier for the subscription that the record is associated with	String
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountObjectId	Unique identifier for the account in Microsoft Entra ID	String
AccountSid	Security Identifier (SID) of the account	String
AccountUpn	User principal name (UPN) of the account	String
ActionType	Type of behavior	String
AdditionalFields	Additional information about the behavior	String
Application	Application that performed the recorded action	String
ApplicationId	Unique identifier for the application	Int32
BehaviorId	Unique identifier for the behavior	String
Categories	Type of threat indicator or breach activity identified by the behavior	String
CloudPlatform	The cloud platform that the resource belongs to, can be Azure, Amazon Web Services, or Google Cloud Platform	String
CloudResource	Cloud resource name	String
CloudResourceId	Unique identifier of the cloud resource accessed.	String
CloudResourceType	Type of cloud resource.	String
CloudSubscriptionId	Unique identifier of the cloud service subscription.	String
DataSources	Products or services that provided information for the behavior	String
DetailedEntityRole	The role of the entity in the behavior	String
DetectionSource	Detection technology or sensor that identified the notable component or activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
EmailClusterId	Identifier for the group of similar emails clustered based on heuristic analysis of their contents	String
EmailSubject	Subject of the email	String
EntityRole	Indicates whether the entity is impacted or merely related	String
EntityType	Type of object, such as a file, a process, a device, or a user	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
LocalIP	IP address assigned to the local machine used during communication	String
MachineGroup		String
NetworkMessageId	Unique identifier for the email, generated by Microsoft 365	String
OAuthApplicationId	Unique identifier of the third-party OAuth application	String
ProcessCommandLine	Command line used to create the new process	String
RegistryKey	Registry key that the recorded action was applied to	String
RegistryValueData	Data of the registry value that the recorded action was applied to	String
RegistryValueName	Name of the registry value that the recorded action was applied to	String
RemoteIP	IP address that was being connected to	String
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ServiceSource	Product or service that identified the behavior	String
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
TenantId		String
ThreatFamily	Malware family that the suspicious or malicious file or process has been classified under	String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Schema changes

Date	Action
2026-10-07	Column _SubscriptionId added
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column CloudResource added
2026-10-07	Column TimeGenerated added
2026-10-07	Column CloudResourceType added
2026-10-07	Column CloudResourceId added
2026-10-07	Column CloudSubscriptionId added
2026-10-07	Column _IsBillable added
2026-10-07	Column _BilledSize added
2026-10-07	Column CloudPlatform added
2026-10-07	Column _ResourceId added
2026-02-27	Column CloudSubscriptionId removed
2026-02-27	Column _SubscriptionId removed
2026-02-27	Column _ResourceId removed
2026-02-27	Column _BilledSize removed
2026-02-27	Column _IsBillable removed
2026-02-27	Column CloudResourceId removed
2026-02-27	Column CloudPlatform removed
2026-02-27	Column CloudResource removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column Type removed
2026-02-27	Column TenantId removed
2026-02-27	Column CloudResourceType removed
2026-02-18	Column CloudResource added
2026-02-18	Column CloudPlatform added
2026-02-18	Column CloudResourceType added
2026-02-18	Column CloudResourceId added
2026-02-18	Column _BilledSize added
2026-02-18	Column _IsBillable added
2026-02-18	Column _ResourceId added
2026-02-18	Column _SubscriptionId added
2026-02-18	Column CloudSubscriptionId added
2026-02-10	Column MachineGroup added
2026-01-02	Table added to tracking