Contains information about behaviors, which in the context of Microsoft Defender XDR refers to a conclusion or insight based on one or more raw events, which can provide analysts more context in investigations
Table retention
HotDays
ColdDays
TotalInteractiveDays
30
0
30
Schema
Name
Description
Type
AccountObjectId
Unique identifier for the account in Microsoft Entra ID
String
AccountUpn
User principal name (UPN) of the account
String
ActionType
Type of behavior
String
AdditionalFields
Additional information about the behavior
String
AttackTechniques
MITRE ATT&CK techniques associated with the activity that triggered the behavior
String
BehaviorId
Unique identifier for the behavior
String
Categories
Type of threat indicator or breach activity identified by the behavior
String
DataSources
Products or services that provided information for the behavior
String
Description
Description of behavior
String
DetectionSource
Detection technology or sensor that identified the notable component or activity
String
DeviceId
Unique identifier for the device in Microsoft Defender for Endpoint
String
EndTime
Date and time of the last activity related to the behavior
DateTime
ServiceSource
Product or service that identified the behavior
String
StartTime
Date and time of the first activity related to the behavior