Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Action

`AdditionalFields`

Submit an example

Action: NamedPipeEvent

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DesiredAccess": 1,
  "FileOperation": "SAMPLEFILE_1.txt",
  "NamedPipeEnd": "VALUE_1",
  "PipeName": "VALUE_2",
  "RemoteClientsAccess": "VALUE_3",
  "SessionId": 1,
  "ThreadId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.DesiredAccess`	integer
`$.FileOperation`	string
`$.NamedPipeEnd`	string
`$.PipeName`	string
`$.RemoteClientsAccess`	string
`$.SessionId`	integer
`$.ThreadId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DriverLoad

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "ImageBase": "1",
  "ImageMD5": "VALUE_1",
  "ImageName": "VALUE_2",
  "ImageSHA1": "VALUE_3",
  "ImageSHA256": "VALUE_4",
  "UserSid": "USERNAME_1"
}

Payload fields and types

Path	Type
`$`	object
`$.ImageBase`	encoded-json
`$.ImageBase`	string
`$.ImageBase::<json>`	integer
`$.ImageMD5`	string
`$.ImageName`	string
`$.ImageSHA1`	string
`$.ImageSHA256`	string
`$.UserSid`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: AsrLsassCredentialTheftBlocked

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsAudit": false,
  "RuleId": "00000000-0000-4000-8000-000000000001"
}

Payload fields and types

Path	Type
`$`	object
`$.IsAudit`	boolean
`$.RuleId`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"StartBoundary\":\"VALUE_2\"}}}",
  "TaskName": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.TimeTrigger`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.StartBoundary`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskUpdated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"CalendarTrigger\":{\"Enabled\":\"false\",\"EndBoundary\":\"VALUE_2\",\"ScheduleByDay\":{\"DaysInterval\":\"1\"},\"StartBoundary\":\"VALUE_3\"}}}",
  "TaskName": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.CalendarTrigger`	object
`$.TaskContent::<json>.Triggers.CalendarTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.CalendarTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.CalendarTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.CalendarTrigger.EndBoundary`	string
`$.TaskContent::<json>.Triggers.CalendarTrigger.ScheduleByDay`	object
`$.TaskContent::<json>.Triggers.CalendarTrigger.ScheduleByDay.DaysInterval`	encoded-json
`$.TaskContent::<json>.Triggers.CalendarTrigger.ScheduleByDay.DaysInterval`	string
`$.TaskContent::<json>.Triggers.CalendarTrigger.ScheduleByDay.DaysInterval::<json>`	integer
`$.TaskContent::<json>.Triggers.CalendarTrigger.StartBoundary`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: AntivirusDetection

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "ThreatName": "VALUE_1",
  "WasExecuting": false
}

Payload fields and types

Path	Type
`$`	object
`$.ThreatName`	string
`$.WasExecuting`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: UsbDriveMounted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "BusType": 1,
  "DriveLetter": "VALUE_1",
  "LoggedOnUsers": [
    "USERNAME_1"
  ],
  "Manufacturer": "VALUE_2",
  "ProductName": "VALUE_3",
  "ProductRevision": "1.5",
  "Volume": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.BusType`	integer
`$.DriveLetter`	string
`$.LoggedOnUsers`	array
`$.LoggedOnUsers[]`	string
`$.Manufacturer`	string
`$.ProductName`	string
`$.ProductRevision`	encoded-json
`$.ProductRevision`	string
`$.ProductRevision::<json>`	number
`$.Volume`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskUpdated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}}}",
  "TaskName": "VALUE_2"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ShellLinkCreateFileEvent

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsOnRemovableMedia": false,
  "ShellLinkShowCommand": "echo SAMPLE_1",
  "VolumeGuidPath": "SAMPLEFILE_1.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.IsOnRemovableMedia`	boolean
`$.ShellLinkShowCommand`	string
`$.VolumeGuidPath`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: AsrLsassCredentialTheftAudited

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsAudit": false,
  "RuleId": "00000000-0000-4000-8000-000000000001"
}

Payload fields and types

Path	Type
`$`	object
`$.IsAudit`	boolean
`$.RuleId`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskUpdated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"@id\":\"VALUE_1\",\"Enabled\":\"false\",\"RandomDelay\":\"VALUE_2\",\"Repetition\":{\"Interval\":\"VALUE_3\",\"StopAtDurationEnd\":\"false\"},\"StartBoundary\":\"VALUE_4\"},\"WnfStateChangeTrigger\":[{\"@id\":\"VALUE_5\",\"Data\":\"VALUE_6\",\"DataOffset\":\"1\",\"Enabled\":\"false\",\"StateName\":\"VALUE_7\"}]}}",
  "TaskName": "VALUE_10"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.TimeTrigger`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.RandomDelay`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.Interval`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.StartBoundary`	string
`$.TaskContent::<json>.Triggers.TimeTrigger["@id"]`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger`	array
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[]`	object
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Data`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].DataOffset`	encoded-json
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].DataOffset`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].DataOffset::<json>`	integer
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Enabled`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].StateName`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[]["@id"]`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: RemoteWmiOperation

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Namespace": "VALUE_1",
  "OperationDetails": "VALUE_2",
  "OperationType": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.Namespace`	string
`$.OperationDetails`	string
`$.OperationType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: PowerShellCommand

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Command": "echo SAMPLE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.Command`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsQueryResponse

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DnsQueryResult": [
    "{\"DnsQueryType\":\"VALUE_1\",\"Result\":\"{\\\"dv3\\\":1,\\\"dv3_1\\\":1,\\\"pq\\\":1}\"}"
  ],
  "DnsQueryString": "VALUE_2"
}

Payload fields and types

Path	Type
`$`	object
`$.DnsQueryResult`	array
`$.DnsQueryResult[]`	encoded-json
`$.DnsQueryResult[]`	string
`$.DnsQueryResult[]::<json>`	object
`$.DnsQueryResult[]::<json>.DnsQueryType`	string
`$.DnsQueryResult[]::<json>.Result`	encoded-json
`$.DnsQueryResult[]::<json>.Result`	string
`$.DnsQueryResult[]::<json>.Result::<json>`	object
`$.DnsQueryResult[]::<json>.Result::<json>.dv3`	integer
`$.DnsQueryResult[]::<json>.Result::<json>.dv3_1`	integer
`$.DnsQueryResult[]::<json>.Result::<json>.pq`	integer
`$.DnsQueryString`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ShellLinkCreateFileEvent

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileSizeInBytes": 1,
  "IsOnRemovableMedia": false,
  "ShellLinkRunAsAdmin": false,
  "ShellLinkShowCommand": "echo SAMPLE_1",
  "VolumeGuidPath": "SAMPLEFILE_1.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.FileSizeInBytes`	integer
`$.IsOnRemovableMedia`	boolean
`$.ShellLinkRunAsAdmin`	boolean
`$.ShellLinkShowCommand`	string
`$.VolumeGuidPath`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: AntivirusScanCompleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Domain": "COMPUTERNAME_1",
  "ScanId": "VALUE_1",
  "ScanParametersIndex": "1",
  "ScanTypeIndex": "VALUE_2",
  "User": "USERNAME_1"
}

Payload fields and types

Path	Type
`$`	object
`$.Domain`	string
`$.ScanId`	string
`$.ScanParametersIndex`	encoded-json
`$.ScanParametersIndex`	string
`$.ScanParametersIndex::<json>`	integer
`$.ScanTypeIndex`	string
`$.User`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskUpdated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"RandomDelay\":\"VALUE_2\",\"Repetition\":{\"Interval\":\"VALUE_3\",\"StopAtDurationEnd\":\"false\"},\"StartBoundary\":\"VALUE_4\"}}}",
  "TaskName": "VALUE_5"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.TimeTrigger`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.RandomDelay`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.Interval`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.StartBoundary`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: AntivirusScanCancelled

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Domain": "COMPUTERNAME_1",
  "ScanId": "VALUE_1",
  "ScanParametersIndex": "1",
  "ScanTypeIndex": "VALUE_2",
  "User": "USERNAME_1"
}

Payload fields and types

Path	Type
`$`	object
`$.Domain`	string
`$.ScanId`	string
`$.ScanParametersIndex`	encoded-json
`$.ScanParametersIndex`	string
`$.ScanParametersIndex::<json>`	integer
`$.ScanTypeIndex`	string
`$.User`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ReadProcessMemoryApiCall

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "TotalBytesCopied": 1
}

Payload fields and types

Path	Type
`$`	object
`$.TotalBytesCopied`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskUpdated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"StartBoundary\":\"VALUE_2\"}}}",
  "TaskName": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.TimeTrigger`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.StartBoundary`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: NtAllocateVirtualMemoryApiCall

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "BaseAddress": 1,
  "ProtectionMask": 1,
  "RegionSize": 1
}

Payload fields and types

Path	Type
`$`	object
`$.BaseAddress`	integer
`$.ProtectionMask`	integer
`$.RegionSize`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LdapSearch

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AttributeList": [
    "VALUE_1"
  ],
  "DistinguishedName": "VALUE_12",
  "ScopeOfSearch": "VALUE_13",
  "SearchFilter": "VALUE_14"
}

Payload fields and types

Path	Type
`$`	object
`$.AttributeList`	array
`$.AttributeList[]`	string
`$.DistinguishedName`	string
`$.ScopeOfSearch`	string
`$.SearchFilter`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: RemoteWmiOperation

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "OperationType": "VALUE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.OperationType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: UsbDriveMounted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "BusType": 1,
  "DriveLetter": "VALUE_1",
  "LoggedOnUsers": [
    "USERNAME_1"
  ],
  "ProductName": "VALUE_2",
  "ProductRevision": "1.5",
  "Volume": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.BusType`	integer
`$.DriveLetter`	string
`$.LoggedOnUsers`	array
`$.LoggedOnUsers[]`	string
`$.ProductName`	string
`$.ProductRevision`	encoded-json
`$.ProductRevision`	string
`$.ProductRevision::<json>`	number
`$.Volume`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: BruteForceActivityDetected

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AttackType": "VALUE_1",
  "DomainName": "COMPUTERNAME_1",
  "IP": "192.0.2.1",
  "Username": "USERNAME_1",
  "WorkStationName": "VALUE_2"
}

Payload fields and types

Path	Type
`$`	object
`$.AttackType`	string
`$.DomainName`	string
`$.IP`	string
`$.Username`	string
`$.WorkStationName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":null,\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"RandomDelay\":\"VALUE_1\",\"Repetition\":{\"Interval\":\"VALUE_2\",\"StopAtDurationEnd\":\"false\"},\"StartBoundary\":\"VALUE_3\"}}}",
  "TaskName": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	null
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.TimeTrigger`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.RandomDelay`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.Interval`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Repetition.StopAtDurationEnd::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.StartBoundary`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DpapiAccessed

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "CallerProcessID": 1,
  "MasterKeyGUID": "00000000-0000-4000-8000-000000000001",
  "OperationType": "VALUE_1",
  "ReturnValue": 1
}

Payload fields and types

Path	Type
`$`	object
`$.CallerProcessID`	integer
`$.MasterKeyGUID`	string
`$.OperationType`	string
`$.ReturnValue`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsQueryResponse

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DnsQueryResult": [
    "{\"DnsQueryType\":\"VALUE_1\",\"Result\":\"VALUE_2\"}"
  ],
  "DnsQueryString": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.DnsQueryResult`	array
`$.DnsQueryResult[]`	encoded-json
`$.DnsQueryResult[]`	string
`$.DnsQueryResult[]::<json>`	object
`$.DnsQueryResult[]::<json>.DnsQueryType`	string
`$.DnsQueryResult[]::<json>.Result`	string
`$.DnsQueryString`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ShellLinkCreateFileEvent

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileSizeInBytes": 1,
  "IsOnRemovableMedia": false,
  "ShellLinkIconPath": "SAMPLEFILE_1.txt",
  "ShellLinkRunAsAdmin": false,
  "ShellLinkShowCommand": "echo SAMPLE_1",
  "VolumeGuidPath": "SAMPLEFILE_2.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.FileSizeInBytes`	integer
`$.IsOnRemovableMedia`	boolean
`$.ShellLinkIconPath`	string
`$.ShellLinkRunAsAdmin`	boolean
`$.ShellLinkShowCommand`	string
`$.VolumeGuidPath`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DnsQueryResponse

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DnsQueryString": "VALUE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.DnsQueryString`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LdapSearch

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AttributeList": [
    "VALUE_1"
  ],
  "ScopeOfSearch": "VALUE_2",
  "SearchFilter": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.AttributeList`	array
`$.AttributeList[]`	string
`$.ScopeOfSearch`	string
`$.SearchFilter`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ShellLinkCreateFileEvent

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileSizeInBytes": 1,
  "IsOnRemovableMedia": false,
  "ShellLinkIconPath": "SAMPLEFILE_1.txt",
  "ShellLinkRunAsAdmin": false,
  "ShellLinkShowCommand": "echo SAMPLE_1",
  "ShellLinkWorkingDirectory": "VALUE_1",
  "VolumeGuidPath": "SAMPLEFILE_2.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.FileSizeInBytes`	integer
`$.IsOnRemovableMedia`	boolean
`$.ShellLinkIconPath`	string
`$.ShellLinkRunAsAdmin`	boolean
`$.ShellLinkShowCommand`	string
`$.ShellLinkWorkingDirectory`	string
`$.VolumeGuidPath`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessCreatedUsingWmiQuery

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "ClientMachine": "VALUE_1",
  "IsRemoteMachine": false
}

Payload fields and types

Path	Type
`$`	object
`$.ClientMachine`	string
`$.IsRemoteMachine`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"WnfStateChangeTrigger\":{\"Data\":\"VALUE_2\",\"DataOffset\":\"1\",\"Enabled\":\"false\",\"StateName\":\"VALUE_3\"}}}",
  "TaskName": "VALUE_4"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger`	object
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.Data`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.DataOffset`	encoded-json
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.DataOffset`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.DataOffset::<json>`	integer
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger.StateName`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DpapiAccessed

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "CallerProcessID": 1,
  "Flags": "VALUE_1",
  "MasterKeyGUID": "00000000-0000-4000-8000-000000000001",
  "OperationType": "VALUE_2",
  "ProtectionFlags": "VALUE_3",
  "ReturnValue": 1
}

Payload fields and types

Path	Type
`$`	object
`$.CallerProcessID`	integer
`$.Flags`	string
`$.MasterKeyGUID`	string
`$.OperationType`	string
`$.ProtectionFlags`	string
`$.ReturnValue`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: RemoteDesktopConnection

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "Protocol": "VALUE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.Protocol`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LdapSearch

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "AttributeList": [
    "VALUE_1"
  ],
  "DistinguishedName": "VALUE_2",
  "ScopeOfSearch": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.AttributeList`	array
`$.AttributeList[]`	string
`$.DistinguishedName`	string
`$.ScopeOfSearch`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"TimeTrigger\":{\"Enabled\":\"false\",\"StartBoundary\":\"VALUE_2\"},\"WnfStateChangeTrigger\":[{\"@id\":\"VALUE_3\",\"Data\":\"VALUE_4\",\"DataOffset\":\"1\",\"Enabled\":\"false\",\"StateName\":\"VALUE_5\"}]}}",
  "TaskName": "VALUE_9"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.TimeTrigger`	object
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.TimeTrigger.Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.TimeTrigger.StartBoundary`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger`	array
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[]`	object
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Data`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].DataOffset`	encoded-json
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].DataOffset`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].DataOffset::<json>`	integer
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Enabled`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].Enabled::<json>`	boolean
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[].StateName`	string
`$.TaskContent::<json>.Triggers.WnfStateChangeTrigger[]["@id"]`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: DpapiAccessed

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "CallerProcessID": 1,
  "Flags": "VALUE_1",
  "MasterKeyGUID": "00000000-0000-4000-8000-000000000001",
  "OperationType": "VALUE_2",
  "ReturnValue": 1
}

Payload fields and types

Path	Type
`$`	object
`$.CallerProcessID`	integer
`$.Flags`	string
`$.MasterKeyGUID`	string
`$.OperationType`	string
`$.ReturnValue`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: NtAllocateVirtualMemoryRemoteApiCall

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IntegrityLevel": 1
}

Payload fields and types

Path	Type
`$`	object
`$.IntegrityLevel`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: CreateRemoteThreadApiCall

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IntegrityLevel": 1
}

Payload fields and types

Path	Type
`$`	object
`$.IntegrityLevel`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ProcessPrimaryTokenModified

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "CurrentTokenIntegrityLevel": "1",
  "CurrentTokenPointer": "1",
  "CurrentTokenPrivEnabled": "1",
  "CurrentTokenSource": "VALUE_1",
  "CurrentTokenUserSid": "USERNAME_1",
  "OriginalTokenIntegrityLevel": "1",
  "OriginalTokenPointer": "1",
  "OriginalTokenPrivEnabled": "1",
  "OriginalTokenPrivPresent": "1",
  "OriginalTokenSource": "VALUE_1",
  "OriginalTokenUserSid": "USERNAME_1",
  "SystemTokenPointer": "1",
  "TokenModificationProperties": "{\"currentTokenIntegrityLevelName\":\"VALUE_2\",\"isChangedToSystemToken\":false,\"originalTokenIntegrityLevelName\":\"VALUE_2\",\"privilegesFlags\":[],\"tokenChangeDescription\":\"VALUE_3\"}"
}

Payload fields and types

Path	Type
`$`	object
`$.CurrentTokenIntegrityLevel`	encoded-json
`$.CurrentTokenIntegrityLevel`	string
`$.CurrentTokenIntegrityLevel::<json>`	integer
`$.CurrentTokenPointer`	encoded-json
`$.CurrentTokenPointer`	string
`$.CurrentTokenPointer::<json>`	integer
`$.CurrentTokenPrivEnabled`	encoded-json
`$.CurrentTokenPrivEnabled`	string
`$.CurrentTokenPrivEnabled::<json>`	integer
`$.CurrentTokenSource`	string
`$.CurrentTokenUserSid`	string
`$.OriginalTokenIntegrityLevel`	encoded-json
`$.OriginalTokenIntegrityLevel`	string
`$.OriginalTokenIntegrityLevel::<json>`	integer
`$.OriginalTokenPointer`	encoded-json
`$.OriginalTokenPointer`	string
`$.OriginalTokenPointer::<json>`	integer
`$.OriginalTokenPrivEnabled`	encoded-json
`$.OriginalTokenPrivEnabled`	string
`$.OriginalTokenPrivEnabled::<json>`	integer
`$.OriginalTokenPrivPresent`	encoded-json
`$.OriginalTokenPrivPresent`	string
`$.OriginalTokenPrivPresent::<json>`	integer
`$.OriginalTokenSource`	string
`$.OriginalTokenUserSid`	string
`$.SystemTokenPointer`	encoded-json
`$.SystemTokenPointer`	string
`$.SystemTokenPointer::<json>`	integer
`$.TokenModificationProperties`	encoded-json
`$.TokenModificationProperties`	string
`$.TokenModificationProperties::<json>`	object
`$.TokenModificationProperties::<json>.currentTokenIntegrityLevelName`	string
`$.TokenModificationProperties::<json>.isChangedToSystemToken`	boolean
`$.TokenModificationProperties::<json>.originalTokenIntegrityLevelName`	string
`$.TokenModificationProperties::<json>.privilegesFlags`	array
`$.TokenModificationProperties::<json>.tokenChangeDescription`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskName": "VALUE_1"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: OpenProcessApiCall

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "DesiredAccess": 1
}

Payload fields and types

Path	Type
`$`	object
`$.DesiredAccess`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ExploitGuardWin32SystemCallBlocked

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsAudit": false
}

Payload fields and types

Path	Type
`$`	object
`$.IsAudit`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: ScheduledTaskUpdated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "SubjectUserName": "USERNAME_1",
  "TaskContent": "{\"Actions\":{\"Exec\":{\"Arguments\":\"VALUE_1\",\"Command\":\"echo SAMPLE_1\"}},\"Triggers\":{\"LogonTrigger\":{\"Delay\":\"VALUE_2\",\"Enabled\":\"false\"}}}",
  "TaskName": "VALUE_3"
}

Payload fields and types

Path	Type
`$`	object
`$.SubjectUserName`	string
`$.TaskContent`	encoded-json
`$.TaskContent`	string
`$.TaskContent::<json>`	object
`$.TaskContent::<json>.Actions`	object
`$.TaskContent::<json>.Actions.Exec`	object
`$.TaskContent::<json>.Actions.Exec.Arguments`	string
`$.TaskContent::<json>.Actions.Exec.Command`	string
`$.TaskContent::<json>.Triggers`	object
`$.TaskContent::<json>.Triggers.LogonTrigger`	object
`$.TaskContent::<json>.Triggers.LogonTrigger.Delay`	string
`$.TaskContent::<json>.Triggers.LogonTrigger.Enabled`	encoded-json
`$.TaskContent::<json>.Triggers.LogonTrigger.Enabled`	string
`$.TaskContent::<json>.Triggers.LogonTrigger.Enabled::<json>`	boolean
`$.TaskName`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

DeviceEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountSid	Security Identifier (SID) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
CreatedProcessSessionId	Windows session ID of the created process	Int64
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FileName	Name of the file that the recorded action was applied to	String
FileOriginIP	IP address where the file was downloaded from	String
FileOriginUrl	URL where the file was downloaded from	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessLogonId	Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts.	Int64
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
IsProcessRemoteSession	Indicates whether the created process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
LocalIP	IP address assigned to the local machine used during communication	String
LocalPort	TCP port on the local machine used during communication	Int32
LogonId	Identifier for a logon session. This identifier is unique on the same machine only between restarts	Int64
MachineGroup		String
MD5	MD5 hash of the file that the recorded action was applied to	String
ProcessCommandLine	Command line used to create the new process	String
ProcessCreationTime	Date and time the process was created	DateTime
ProcessId	Process ID (PID) of the newly created process	Int64
ProcessRemoteSessionDeviceName	Device name of the remote device from which the created process’s RDP session was initiated	String
ProcessRemoteSessionIP	IP address of the remote device from which the created process’s RDP session was initiated	String
ProcessTokenElevation	Indicates the type of token elevation applied to the newly created process. Possible values: TokenElevationTypeLimited (restricted), TokenElevationTypeDefault (standard), and TokenElevationTypeFull (elevated)	String
RegistryKey	Registry key that the recorded action was applied to	String
RegistryValueData	Data of the registry value that the recorded action was applied to	String
RegistryValueName	Name of the registry value that the recorded action was applied to	String
RemoteDeviceName	Name of the device that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information.	String
RemoteIP	IP address that was being connected to	String
RemotePort	TCP port on the remote device that was being connected to	Int32
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
AccountCheckedForBlankPassword	An account was checked for a blank password.
AntivirusDefinitionsUpdated	Security intelligence updates for Windows Defender Antivirus were applied successfully.
AntivirusDefinitionsUpdateFailed	Security intelligence updates for Windows Defender Antivirus were not applied.
AntivirusDetection	Windows Defender Antivirus detected a threat.
AntivirusEmergencyUpdatesInstalled	Emergency security intelligence updates for Windows Defender Antivirus were applied.
AntivirusError	Windows Defender Antivirus encountered an error while taking action on malware or a potentially unwanted application.
AntivirusMalwareActionFailed	Windows Defender Antivirus attempted to take action on malware or a potentially unwanted application but the action failed.
AntivirusMalwareBlocked	Windows Defender Antivirus blocked files or activity involving malware potentially unwanted applications or suspicious behavior.
AntivirusReport	Microsoft Defender Antivirus reported a threat, which can either be a memory, boot sector, or rootkit threat.
AntivirusScanCancelled	A Windows Defender Antivirus scan was cancelled.
AntivirusScanCompleted	A Windows Defender Antivirus scan completed successfully.
AntivirusScanFailed	A Windows Defender Antivirus scan did not complete successfully.
AntivirusTroubleshootModeEvent	The troubleshooting mode in Microsoft Defender Antivirus was used.
AppControlAppInstallationAudited	Application control detected the installation of an untrusted app.
AppControlAppInstallationBlocked	Application control blocked the installation of an untrusted app.
AppControlCIScriptAudited	A script or MSI file generated by Windows LockDown Policy was audited.
AppControlCIScriptBlocked	A script or MSI file generated by Windows LockDown Policy was blocked.
AppControlCodeIntegrityDriverRevoked	Application control found a driver with a revoked certificate.
AppControlCodeIntegrityImageAudited	Application control detected an executable file that violated code integrity policies.
AppControlCodeIntegrityImageRevoked	Application control found an executable file with a revoked certificate.
AppControlCodeIntegrityOriginAllowed	Application control allowed a file due to its good reputation (ISG) or installation source (managed installer).
AppControlCodeIntegrityOriginAudited	Application control would have blocked a file due to its bad reputation (ISG) or installation source (managed installer) if the policy was enforced.
AppControlCodeIntegrityOriginBlocked	Application control blocked a file due to its bad reputation (ISG) or installation source (managed installer).
AppControlCodeIntegrityPolicyAudited	Application control detected a code integrity policy violation.
AppControlCodeIntegrityPolicyBlocked	Application control blocked a code integrity policy violation.
AppControlCodeIntegrityPolicyLoaded	An application control code integrity policy was loaded.
AppControlCodeIntegritySigningInformation	Application control signing information was generated.
AppControlExecutableAudited	Application control detected the use of an untrusted executable.
AppControlExecutableBlocked	Application control blocked the use of an untrusted executable.
AppControlPackagedAppAudited	Application control detected the use of an untrusted packaged app.
AppControlPackagedAppBlocked	Application control blocked the installation of an untrusted packaged app.
AppControlPolicyApplied	An application control policy was applied to the device.
AppControlScriptAudited	Application control detected the use of an untrusted script.
AppControlScriptBlocked	Application control blocked the use of an untrusted script.
AppGuardBrowseToUrl	A URL was accessed from within an application guard container.
AppGuardCreateContainer	Application guard initiated an isolated container.
AppGuardLaunchedWithUrl	The opening of an untrusted URL has initiated an application guard container.
AppGuardResumeContainer	Application guard resumed an isolated container from a suspended state.
AppGuardStopContainer	Application guard stopped an isolated container.
AppGuardSuspendContainer	Application guard suspended an isolated container.
AppLockerBlockExecutable	AppLocker prevented an untrusted executable from running.
AppLockerBlockPackagedApp	AppLocker prevented an untrusted packaged app from running.
AppLockerBlockPackagedAppInstallation	AppLocker prevented the installation of an untrusted packaged app.
AppLockerBlockScript	AppLocker prevented an untrusted script from running.
AsrAbusedSystemToolAudited	An attack surface reduction rule detected use of a copied or impersonated system tool.
AsrAbusedSystemToolBlocked	An attack surface reduction rule blocked use of a copied or impersonated system tool.
AsrAbusedSystemToolWarnBypassed	User excluded ASR block for “Block use of a copied or impersonated system tools” rule enabled in WARN mode.
AsrAdobeReaderChildProcessAudited	An attack surface reduction rule detected Adobe Reader creating a child process.
AsrAdobeReaderChildProcessBlocked	An attack surface reduction rule blocked Adobe Reader from creating a child process.
AsrAdobeReaderChildProcessWarnBypassed	User excluded ASR block for “Block Adobe Reader from creating child processes” rule enabled in WARN mode.
AsrExecutableEmailContentAudited	An attack surface reduction rule detected the launch of executable content from an email client and or webmail.
AsrExecutableEmailContentBlocked	An attack surface reduction rule blocked executable content from an email client and or webmail.
AsrExecutableEmailContentWarnBypassed	User excluded ASR block for “Block Launching of executable content from email attachment” rule enabled in WARN mode.
AsrExecutableOfficeContentAudited	An attack surface reduction rule detected an Office application creating executable content.
AsrExecutableOfficeContentBlocked	An attack surface reduction rule blocked an Office application from creating executable content.
AsrExecutableOfficeContentWarnBypassed	User excluded ASR block for “Block Office applications from creating executable content” rule enabled in WARN mode.
AsrLsassCredentialTheftAudited	An attack surface reduction rule detected possible credential theft from lsass.exe.
AsrLsassCredentialTheftBlocked	An attack surface reduction rule blocked possible credential theft from lsass.exe.
AsrLsassCredentialTheftWarnBypassed	User excluded ASR block for “Block credential stealing from the Windows local security authority subsystem (lsass.exe)” rule enabled in WARN mode.
AsrObfuscatedScriptAudited	An attack surface reduction rule detected the execution of scripts that appear obfuscated.
AsrObfuscatedScriptBlocked	An attack surface reduction rule blocked the execution of scripts that appear obfuscated.
AsrObfuscatedScriptWarnBypassed	User excluded ASR block for “Block execution of potentially obfuscated scripts” rule enabled in WARN mode.
AsrOfficeChildProcessAudited	An attack surface reduction rule detected an Office application spawning a child process.
AsrOfficeChildProcessBlocked	An attack surface reduction rule blocked an Office application from creating child processes.
AsrOfficeChildProcessWarnBypassed	User excluded ASR block for “Block all Office applications from creating child processes” rule enabled in WARN mode.
AsrOfficeCommAppChildProcessAudited	An attack surface reduction rule detected an Office communication app attempting to spawn a child process.
AsrOfficeCommAppChildProcessBlocked	An attack surface reduction rule blocked an Office communication app from spawning a child process.
AsrOfficeCommAppChildProcessWarnBypassed	User excluded ASR block for “Block Office communication application from creating child processes” rule enabled in WARN mode.
AsrOfficeMacroWin32ApiCallsAudited	An attack surface reduction rule detected Win32 API calls from Office macros.
AsrOfficeMacroWin32ApiCallsBlocked	An attack surface reduction rule blocked Win32 API calls from Office macros.
AsrOfficeMacroWin32ApiCallsWarnBypassed	User excluded ASR block for “Block Win32 API calls from Office macro” rule enabled in WARN mode.
AsrOfficeProcessInjectionAudited	An attack surface reduction rule detected an Office application injecting code into other processes.
AsrOfficeProcessInjectionBlocked	An attack surface reduction rule blocked an Office application from injecting code into other processes.
AsrOfficeProcessInjectionWarnBypassed	User excluded ASR block for “Block Office applications from injecting code into other processes” rule enabled in WARN mode.
AsrPersistenceThroughWmiAudited	An attack surface reduction rule detected an attempt to establish persistence through WMI event subscription.
AsrPersistenceThroughWmiBlocked	An attack surface reduction rule blocked an attempt to establish persistence through WMI event subscription.
AsrPersistenceThroughWmiWarnBypassed	User excluded ASR block for “Block persistence through WMI event subscription” rule enabled in WARN mode.
AsrPsexecWmiChildProcessAudited	An attack surface reduction rule detected the use of PsExec or WMI commands to spawn a child process.
AsrPsexecWmiChildProcessBlocked	An attack surface reduction rule blocked the use of PsExec or WMI commands to spawn a child process.
AsrPsexecWmiChildProcessWarnBypassed	User excluded ASR block for “Block Process Creations originating from PSExec & WMI commands” rule enabled in WARN mode.
AsrRansomwareAudited	An attack surface reduction rule detected ransomware activity.
AsrRansomwareBlocked	An attack surface reduction rule blocked ransomware activity.
AsrRansomwareWarnBypassed	User excluded ASR block for “Use advanced protection against ransomware” rule enabled in WARN mode.
AsrSafeModeRebootAudited	An attack surface reduction rule detected a configuration attempt to reboot a device in Safe mode.
AsrSafeModeRebootBlocked	An attack surface reduction rule blocked a configuration attempt to reboot a device in Safe mode.
AsrSafeModeRebootWarnBypassed	User excluded ASR block for “Block rebooting machine in Safe Mode” rule enabled in WARN mode.
AsrScriptExecutableDownloadAudited	An attack surface reduction rule detected JavaScript or VBScript code launching downloaded executable content.
AsrScriptExecutableDownloadBlocked	An attack surface reduction rule blocked JavaScript or VBScript code from launching downloaded executable content.
AsrScriptExecutableDownloadWarnBypassed	User excluded ASR block for “Block JavaScript or VBScript from launching downloaded executable content” rule enabled in WARN mode.
AsrUntrustedExecutableAudited	An attack surface reduction rule detected the execution of an untrusted file that doesn’t meet criteria for age or prevalence.
AsrUntrustedExecutableBlocked	An attack surface reduction rule blocked the execution of an untrusted file that doesn’t meet criteria for age or prevalence.
AsrUntrustedExecutableWarnBypassed	User excluded ASR block for “Block executable files from running unless they meet a prevalence, age, or trusted list criteria” rule enabled in WARN mode.
AsrUntrustedUsbProcessAudited	An attack surface reduction rule detected the execution of an untrusted and unsigned processes from a USB device.
AsrUntrustedUsbProcessBlocked	An attack surface reduction rule blocked the execution of an untrusted and unsigned processes from a USB device.
AsrUntrustedUsbProcessWarnBypassed	User excluded ASR block for “Block untrusted and unsigned processes that run from USB” rule enabled in WARN mode.
AsrVulnerableSignedDriverAudited	An attack surface reduction rule detected a signed driver that has known vulnerabilities.
AsrVulnerableSignedDriverBlocked	An attack surface reduction rule blocked a signed driver that has known vulnerabilities.
AsrVulnerableSignedDriverWarnBypassed	User excluded ASR block for “Block abuse of in-the-wild exploited vulnerable signed drivers” rule enabled in WARN mode.
AsrWebShellOnServerAudited	An attack surface reduction rule detected the creation of a webshell on a Windows Server machine.
AsrWebShellOnServerBlocked	An attack surface reduction rule blocked webshell creation activity on a Windows Server machine.
AsrWebShellWarnBypassed	User excluded ASR block for “Block Webshell creation for Servers” rule enabled in WARN mode.
AuditPolicyModification	Changes in the Windows audit policy (which feed events to the event log).
BitLockerAuditCompleted	An audit for BitLocker encryption was completed.
BluetoothPolicyTriggered	A Bluetooth service activity was allowed or blocked by a device control policy.
BrowserLaunchedToOpenUrl	A web browser opened a URL that originated as a link in another application.
BruteForceActivityDetected	Brute-force attempts to sign in were detected by Microsoft Defender for Endpoint.
CertificateServicesApprovedCertificateRequest	Certificate Services approved a certificate request and issued a certificate.
CertificateServicesLoadedTemplate	Certificate Services loaded a certificate template configuration from Active Directory.
CertificateServicesReceivedCertificateRequest	Certificate Services received a certificate request.
ControlFlowGuardViolation	Control Flow Guard terminated an application after detecting an invalid function call
ControlledFolderAccessViolationAudited	Controlled folder access detected an attempt to modify a protected folder.
ControlledFolderAccessViolationBlocked	Controlled folder access blocked an attempt to modify a protected folder.
CreateRemoteThreadApiCall	A thread that runs in the virtual address space of another process was created.
CredentialsBackup	The backup feature in Credential Manager was initiated
DeviceBootAttestationInfo	System Guard generated a boot-time attestation report.
DirectoryServiceObjectCreated	An object was added to the directory service.
DirectoryServiceObjectModified	An object in the directory service was modified.
DnsQueryResponse	A response to a DNS query was sent.
DpapiAccessed	Decription of saved sensitive data encrypted using DPAPI.
DriverLoad	A driver was loaded.
ExploitGuardAcgAudited	Arbitrary code guard (ACG) in exploit protection detected an attempt to modify code page permissions or create unsigned code pages.
ExploitGuardAcgEnforced	Arbitrary code guard (ACG) blocked an attempt to modify code page permissions or create unsigned code pages.
ExploitGuardChildProcessAudited	Exploit protection detected the creation of a child process.
ExploitGuardChildProcessBlocked	Exploit protection blocked the creation of a child process.
ExploitGuardEafViolationAudited	Export address filtering (EAF) in exploit protection detected possible exploitation activity.
ExploitGuardEafViolationBlocked	Export address filtering (EAF) in exploit protection blocked possible exploitation activity.
ExploitGuardIafViolationAudited	Import address filtering (IAF) in exploit protection detected possible exploitation activity.
ExploitGuardIafViolationBlocked	Import address filtering (IAF) in exploit protection blocked possible exploitation activity.
ExploitGuardLowIntegrityImageAudited	Exploit protection detected the launch of a process from a low-integrity file.
ExploitGuardLowIntegrityImageBlocked	Exploit protection blocked the launch of a process from a low-integrity file.
ExploitGuardNetworkProtectionAudited	Network protection detected an attempt to access a malicious or unwanted IP address domain or URL.
ExploitGuardNetworkProtectionBlocked	Network protection blocked a malicious or unwanted IP address domain or URL.
ExploitGuardNonMicrosoftSignedAudited	Exploit protection detected the launch of a process from an image file that is not signed by Microsoft.
ExploitGuardNonMicrosoftSignedBlocked	Exploit protection blocked the launch of a process from an image file that is not signed by Microsoft.
ExploitGuardRopExploitAudited	Exploit protection detected possible return-object programming (ROP) exploitation.
ExploitGuardRopExploitBlocked	Exploit protection blocked possible return-object programming (ROP) exploitation.
ExploitGuardSharedBinaryAudited	Exploit protection detected the launch of a process from a remote shared file.
ExploitGuardSharedBinaryBlocked	Exploit protection blocked the launch of a process from a file in a remote device.
ExploitGuardWin32SystemCallAudited	Exploit protection detected a call to the Windows system API.
ExploitGuardWin32SystemCallBlocked	Exploit protection blocked a call to the Windows system API.
ExternalDeviceConnected	A peripheral connected to this device.
ExternalDeviceDisconnected	A peripheral disconnected from this device.
FileTimestampModificationEvent	File timestamp information was modified.
FirewallInboundConnectionBlocked	A firewall or another application blocked an inbound connection using the Windows Filtering Platform.
FirewallInboundConnectionToAppBlocked	The firewall blocked an inbound connection to an app.
FirewallOutboundConnectionBlocked	A firewall or another application blocked an outbound connection using the Windows Filtering Platform.
FirewallServiceStopped	The firewall service was stopped.
GetAsyncKeyStateApiCall	The GetAsyncKeyState function was called. This function can be used to obtain the states of input keys and buttons.
GetClipboardData	The GetClipboardData function was called. This function can be used obtain the contents of the system clipboard.
LdapSearch	An LDAP search was performed.
LogonRightsSettingEnabled	Interactive logon rights on the machine were granted to a user.
MemoryRemoteProtect	A process has modified the protection mask for a memory region used by another process. This might allow execution of content from non-executable memory.
NamedPipeEvent	A named pipe was created or opened.
NetworkProtectionUserBypassEvent	A user has bypassed network protection and accessed a blocked IP address, domain, or URL.
NetworkShareObjectAccessChecked	A request was made to access a file or folder shared on the network and permissions to the share was evaluated.
NetworkShareObjectAdded	A file or folder was shared on the network.
NetworkShareObjectDeleted	A file or folder shared on the network was deleted.
NetworkShareObjectModified	A file or folder shared on the network was modified.
NtAllocateVirtualMemoryApiCall	Memory was allocated for a process.
NtAllocateVirtualMemoryRemoteApiCall	Memory was allocated for a process remotely.
NtMapViewOfSectionRemoteApiCall	A section of a process’s memory was mapped by calling the function NtMapViewOfSection.
NtProtectVirtualMemoryApiCall	The protection attributes for allocated memory was modified.
OpenProcessApiCall	The OpenProcess function was called indicating an attempt to open a handle to a local process and potentially manipulate that process.
PasswordChangeAttempt	An attempt to change a user password was made.
PlistPropertyModified	A property in the plist was modified.
PnpDeviceAllowed	Device control allowed a trusted plug and play (PnP) device.
PnpDeviceBlocked	Device control blocked an untrusted plug and play (PnP) device.
PnpDeviceConnected	A plug and play (PnP) device was attached.
PowerShellCommand	A PowerShell alias function filter cmdlet external script application script workflow or configuration was executed from a PowerShell host process.
PrintJobBlocked	Device control prevented an untrusted printer from printing.
ProcessCreatedUsingWmiQuery	A process was created using Windows Management Instrumentation (WMI).
ProcessPrimaryTokenModified	A process’s primary token was modified.
PTraceDetected	A process trace (ptrace) was found to have occurred on this device.
QueueUserApcRemoteApiCall	An asynchronous procedure call (APC) was scheduled to execute in a user-mode thread.
ReadProcessMemoryApiCall	The ReadProcessMemory function was called indicating that a process read data from the process memory of another process.
RemoteDesktopConnection	A Remote Desktop connection was established
RemoteWmiOperation	A Windows Management Instrumentation (WMI) operation was initiated from a remote device.
RemovableStorageFileEvent	Removable storage file activity matched a device control removable storage access control policy.
RemovableStoragePolicyTriggered	Device control detected an attempted read/write/execute event from a removable storage device.
SafeDocFileScan	A document was sent to the cloud for analysis while in protected view.
ScheduledTaskCreated	A scheduled task was created.
ScheduledTaskDeleted	A scheduled task was deleted.
ScheduledTaskDisabled	A scheduled task was turned off.
ScheduledTaskEnabled	A scheduled task was turned on.
ScheduledTaskUpdated	A scheduled task was updated.
ScreenshotTaken	A screenshot was taken.
SecurityGroupCreated	A security group was created
SecurityGroupDeleted	A security group was deleted.
SecurityLogCleared	The security log was cleared.
SensitiveFileRead	A file that matched DLP policy was accessed or processes that are reading sensitive files such as ssh keys, Outlook mail archives etc.
ServiceInstalled	A service was installed. This is based on Windows event ID 4697, which requires the advanced security audit setting Audit Security System Extension.
SetThreadContextRemoteApiCall	The context of a thread was set from a user-mode process.
ShellLinkCreateFileEvent	A specially crafted link file (.lnk) was generated. The link file contains unusual attributes that might launch malicious code along with a legitimate file or application.
SmartScreenAppWarning	SmartScreen warned about running a downloaded application that is untrusted or malicious.
SmartScreenExploitWarning	SmartScreen warned about opening a web page that contains an exploit.
SmartScreenUrlWarning	SmartScreen warned about opening a low-reputation URL that might be hosting malware or is a phishing site.
SmartScreenUserOverride	A user has overridden a SmartScreen warning and continued to open an untrusted app or a low-reputation URL.
TamperingAttempt	An attempt to change Microsoft Defender XDR settings was made.
UntrustedWifiConnection	A connection was established to an open Wi-Fi access point that is set to connect automatically.
UsbDriveDriveLetterChanged	The drive letter assigned to a mounted USB storage device was modified
UsbDriveMounted	A USB storage device was mounted as a drive.
UsbDriveUnmounted	A USB storage device was unmounted.
UserAccountAddedToLocalGroup	A user was added to a security-enabled local group.
UserAccountCreated	A local SAM account or a domain account was created.
UserAccountDeleted	A user account was deleted.
UserAccountModified	A user account was modified.
UserAccountPasswordResetAttempt	An attempt was made to reset an account’s password.
UserAccountRemovedFromLocalGroup	A user was removed from a security-enabled local group.
WmiBindEventFilterToConsumer	A filter for WMI events was bound to a consumer. This enables listening for all kinds of system events and triggering corresponding actions, including potentially malicious ones.
WriteToLsassProcessMemory	The WriteProcessMemory function was called indicating that a process has written data into memory for another process.

Schema changes

Date	Action
2026-10-07	Column TimeGenerated added
2026-10-07	Column SourceSystem added
2026-10-07	Column Type added
2026-10-07	Column TenantId added
2026-10-07	Column MachineGroup added
2026-03-23	Action type added: CertificateServicesReceivedCertificateRequest
2026-03-23	Action type added: CertificateServicesLoadedTemplate
2026-03-23	Action type added: CertificateServicesApprovedCertificateRequest
2026-02-27	Column TimeGenerated removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column Type removed
2026-02-27	Column TenantId removed
2026-02-27	Column MachineGroup removed
2026-01-12	Action type added: UserAccountPasswordResetAttempt
2026-01-02	Action type added: ExternalDeviceDisconnected
2026-01-02	Action type added: ExternalDeviceConnected
2024-10-18	Table added to tracking

Known observations

Value casing varies

Fields: FileName, FolderPath, AccountDomain, AccountName, RemoteUrl, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountUpn, InitiatingProcessVersionInfoCompanyName, InitiatingProcessVersionInfoProductName, InitiatingProcessVersionInfoInternalFileName, InitiatingProcessVersionInfoOriginalFileName, InitiatingProcessVersionInfoFileDescription, InitiatingProcessParentFileName, AdditionalFields.

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.

DeviceEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountSid	Security Identifier (SID) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
CreatedProcessSessionId	Windows session ID of the created process	Int64
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FileName	Name of the file that the recorded action was applied to	String
FileOriginIP	IP address where the file was downloaded from	String
FileOriginUrl	URL where the file was downloaded from	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessLogonId	Identifier for a logon session of the process that initiated the event. This identifier is unique on the same machine only between restarts.	Int64
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
IsProcessRemoteSession	Indicates whether the created process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
LocalIP	IP address assigned to the local machine used during communication	String
LocalPort	TCP port on the local machine used during communication	Int32
LogonId	Identifier for a logon session. This identifier is unique on the same machine only between restarts	Int64
MachineGroup		String
MD5	MD5 hash of the file that the recorded action was applied to	String
ProcessCommandLine	Command line used to create the new process	String
ProcessCreationTime	Date and time the process was created	DateTime
ProcessId	Process ID (PID) of the newly created process	Int64
ProcessRemoteSessionDeviceName	Device name of the remote device from which the created process’s RDP session was initiated	String
ProcessRemoteSessionIP	IP address of the remote device from which the created process’s RDP session was initiated	String
ProcessTokenElevation	Indicates the type of token elevation applied to the newly created process. Possible values: TokenElevationTypeLimited (restricted), TokenElevationTypeDefault (standard), and TokenElevationTypeFull (elevated)	String
RegistryKey	Registry key that the recorded action was applied to	String
RegistryValueData	Data of the registry value that the recorded action was applied to	String
RegistryValueName	Name of the registry value that the recorded action was applied to	String
RemoteDeviceName	Name of the device that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information.	String
RemoteIP	IP address that was being connected to	String
RemotePort	TCP port on the remote device that was being connected to	Int32
RemoteUrl	URL or fully qualified domain name (FQDN) that was being connected to	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
AccountCheckedForBlankPassword	An account was checked for a blank password.
AntivirusDefinitionsUpdated	Security intelligence updates for Windows Defender Antivirus were applied successfully.
AntivirusDefinitionsUpdateFailed	Security intelligence updates for Windows Defender Antivirus were not applied.
AntivirusDetection	Windows Defender Antivirus detected a threat.
AntivirusEmergencyUpdatesInstalled	Emergency security intelligence updates for Windows Defender Antivirus were applied.
AntivirusError	Windows Defender Antivirus encountered an error while taking action on malware or a potentially unwanted application.
AntivirusMalwareActionFailed	Windows Defender Antivirus attempted to take action on malware or a potentially unwanted application but the action failed.
AntivirusMalwareBlocked	Windows Defender Antivirus blocked files or activity involving malware potentially unwanted applications or suspicious behavior.
AntivirusReport	Microsoft Defender Antivirus reported a threat, which can either be a memory, boot sector, or rootkit threat.
AntivirusScanCancelled	A Windows Defender Antivirus scan was cancelled.
AntivirusScanCompleted	A Windows Defender Antivirus scan completed successfully.
AntivirusScanFailed	A Windows Defender Antivirus scan did not complete successfully.
AntivirusTroubleshootModeEvent	The troubleshooting mode in Microsoft Defender Antivirus was used.
AppControlAppInstallationAudited	Application control detected the installation of an untrusted app.
AppControlAppInstallationBlocked	Application control blocked the installation of an untrusted app.
AppControlCIScriptAudited	A script or MSI file generated by Windows LockDown Policy was audited.
AppControlCIScriptBlocked	A script or MSI file generated by Windows LockDown Policy was blocked.
AppControlCodeIntegrityDriverRevoked	Application control found a driver with a revoked certificate.
AppControlCodeIntegrityImageAudited	Application control detected an executable file that violated code integrity policies.
AppControlCodeIntegrityImageRevoked	Application control found an executable file with a revoked certificate.
AppControlCodeIntegrityOriginAllowed	Application control allowed a file due to its good reputation (ISG) or installation source (managed installer).
AppControlCodeIntegrityOriginAudited	Application control would have blocked a file due to its bad reputation (ISG) or installation source (managed installer) if the policy was enforced.
AppControlCodeIntegrityOriginBlocked	Application control blocked a file due to its bad reputation (ISG) or installation source (managed installer).
AppControlCodeIntegrityPolicyAudited	Application control detected a code integrity policy violation.
AppControlCodeIntegrityPolicyBlocked	Application control blocked a code integrity policy violation.
AppControlCodeIntegrityPolicyLoaded	An application control code integrity policy was loaded.
AppControlCodeIntegritySigningInformation	Application control signing information was generated.
AppControlExecutableAudited	Application control detected the use of an untrusted executable.
AppControlExecutableBlocked	Application control blocked the use of an untrusted executable.
AppControlPackagedAppAudited	Application control detected the use of an untrusted packaged app.
AppControlPackagedAppBlocked	Application control blocked the installation of an untrusted packaged app.
AppControlPolicyApplied	An application control policy was applied to the device.
AppControlScriptAudited	Application control detected the use of an untrusted script.
AppControlScriptBlocked	Application control blocked the use of an untrusted script.
AppGuardBrowseToUrl	A URL was accessed from within an application guard container.
AppGuardCreateContainer	Application guard initiated an isolated container.
AppGuardLaunchedWithUrl	The opening of an untrusted URL has initiated an application guard container.
AppGuardResumeContainer	Application guard resumed an isolated container from a suspended state.
AppGuardStopContainer	Application guard stopped an isolated container.
AppGuardSuspendContainer	Application guard suspended an isolated container.
AppLockerBlockExecutable	AppLocker prevented an untrusted executable from running.
AppLockerBlockPackagedApp	AppLocker prevented an untrusted packaged app from running.
AppLockerBlockPackagedAppInstallation	AppLocker prevented the installation of an untrusted packaged app.
AppLockerBlockScript	AppLocker prevented an untrusted script from running.
AsrAbusedSystemToolAudited	An attack surface reduction rule detected use of a copied or impersonated system tool.
AsrAbusedSystemToolBlocked	An attack surface reduction rule blocked use of a copied or impersonated system tool.
AsrAbusedSystemToolWarnBypassed	User excluded ASR block for “Block use of a copied or impersonated system tools” rule enabled in WARN mode.
AsrAdobeReaderChildProcessAudited	An attack surface reduction rule detected Adobe Reader creating a child process.
AsrAdobeReaderChildProcessBlocked	An attack surface reduction rule blocked Adobe Reader from creating a child process.
AsrAdobeReaderChildProcessWarnBypassed	User excluded ASR block for “Block Adobe Reader from creating child processes” rule enabled in WARN mode.
AsrExecutableEmailContentAudited	An attack surface reduction rule detected the launch of executable content from an email client and or webmail.
AsrExecutableEmailContentBlocked	An attack surface reduction rule blocked executable content from an email client and or webmail.
AsrExecutableEmailContentWarnBypassed	User excluded ASR block for “Block Launching of executable content from email attachment” rule enabled in WARN mode.
AsrExecutableOfficeContentAudited	An attack surface reduction rule detected an Office application creating executable content.
AsrExecutableOfficeContentBlocked	An attack surface reduction rule blocked an Office application from creating executable content.
AsrExecutableOfficeContentWarnBypassed	User excluded ASR block for “Block Office applications from creating executable content” rule enabled in WARN mode.
AsrLsassCredentialTheftAudited	An attack surface reduction rule detected possible credential theft from lsass.exe.
AsrLsassCredentialTheftBlocked	An attack surface reduction rule blocked possible credential theft from lsass.exe.
AsrLsassCredentialTheftWarnBypassed	User excluded ASR block for “Block credential stealing from the Windows local security authority subsystem (lsass.exe)” rule enabled in WARN mode.
AsrObfuscatedScriptAudited	An attack surface reduction rule detected the execution of scripts that appear obfuscated.
AsrObfuscatedScriptBlocked	An attack surface reduction rule blocked the execution of scripts that appear obfuscated.
AsrObfuscatedScriptWarnBypassed	User excluded ASR block for “Block execution of potentially obfuscated scripts” rule enabled in WARN mode.
AsrOfficeChildProcessAudited	An attack surface reduction rule detected an Office application spawning a child process.
AsrOfficeChildProcessBlocked	An attack surface reduction rule blocked an Office application from creating child processes.
AsrOfficeChildProcessWarnBypassed	User excluded ASR block for “Block all Office applications from creating child processes” rule enabled in WARN mode.
AsrOfficeCommAppChildProcessAudited	An attack surface reduction rule detected an Office communication app attempting to spawn a child process.
AsrOfficeCommAppChildProcessBlocked	An attack surface reduction rule blocked an Office communication app from spawning a child process.
AsrOfficeCommAppChildProcessWarnBypassed	User excluded ASR block for “Block Office communication application from creating child processes” rule enabled in WARN mode.
AsrOfficeMacroWin32ApiCallsAudited	An attack surface reduction rule detected Win32 API calls from Office macros.
AsrOfficeMacroWin32ApiCallsBlocked	An attack surface reduction rule blocked Win32 API calls from Office macros.
AsrOfficeMacroWin32ApiCallsWarnBypassed	User excluded ASR block for “Block Win32 API calls from Office macro” rule enabled in WARN mode.
AsrOfficeProcessInjectionAudited	An attack surface reduction rule detected an Office application injecting code into other processes.
AsrOfficeProcessInjectionBlocked	An attack surface reduction rule blocked an Office application from injecting code into other processes.
AsrOfficeProcessInjectionWarnBypassed	User excluded ASR block for “Block Office applications from injecting code into other processes” rule enabled in WARN mode.
AsrPersistenceThroughWmiAudited	An attack surface reduction rule detected an attempt to establish persistence through WMI event subscription.
AsrPersistenceThroughWmiBlocked	An attack surface reduction rule blocked an attempt to establish persistence through WMI event subscription.
AsrPersistenceThroughWmiWarnBypassed	User excluded ASR block for “Block persistence through WMI event subscription” rule enabled in WARN mode.
AsrPsexecWmiChildProcessAudited	An attack surface reduction rule detected the use of PsExec or WMI commands to spawn a child process.
AsrPsexecWmiChildProcessBlocked	An attack surface reduction rule blocked the use of PsExec or WMI commands to spawn a child process.
AsrPsexecWmiChildProcessWarnBypassed	User excluded ASR block for “Block Process Creations originating from PSExec & WMI commands” rule enabled in WARN mode.
AsrRansomwareAudited	An attack surface reduction rule detected ransomware activity.
AsrRansomwareBlocked	An attack surface reduction rule blocked ransomware activity.
AsrRansomwareWarnBypassed	User excluded ASR block for “Use advanced protection against ransomware” rule enabled in WARN mode.
AsrSafeModeRebootAudited	An attack surface reduction rule detected a configuration attempt to reboot a device in Safe mode.
AsrSafeModeRebootBlocked	An attack surface reduction rule blocked a configuration attempt to reboot a device in Safe mode.
AsrSafeModeRebootWarnBypassed	User excluded ASR block for “Block rebooting machine in Safe Mode” rule enabled in WARN mode.
AsrScriptExecutableDownloadAudited	An attack surface reduction rule detected JavaScript or VBScript code launching downloaded executable content.
AsrScriptExecutableDownloadBlocked	An attack surface reduction rule blocked JavaScript or VBScript code from launching downloaded executable content.
AsrScriptExecutableDownloadWarnBypassed	User excluded ASR block for “Block JavaScript or VBScript from launching downloaded executable content” rule enabled in WARN mode.
AsrUntrustedExecutableAudited	An attack surface reduction rule detected the execution of an untrusted file that doesn’t meet criteria for age or prevalence.
AsrUntrustedExecutableBlocked	An attack surface reduction rule blocked the execution of an untrusted file that doesn’t meet criteria for age or prevalence.
AsrUntrustedExecutableWarnBypassed	User excluded ASR block for “Block executable files from running unless they meet a prevalence, age, or trusted list criteria” rule enabled in WARN mode.
AsrUntrustedUsbProcessAudited	An attack surface reduction rule detected the execution of an untrusted and unsigned processes from a USB device.
AsrUntrustedUsbProcessBlocked	An attack surface reduction rule blocked the execution of an untrusted and unsigned processes from a USB device.
AsrUntrustedUsbProcessWarnBypassed	User excluded ASR block for “Block untrusted and unsigned processes that run from USB” rule enabled in WARN mode.
AsrVulnerableSignedDriverAudited	An attack surface reduction rule detected a signed driver that has known vulnerabilities.
AsrVulnerableSignedDriverBlocked	An attack surface reduction rule blocked a signed driver that has known vulnerabilities.
AsrVulnerableSignedDriverWarnBypassed	User excluded ASR block for “Block abuse of in-the-wild exploited vulnerable signed drivers” rule enabled in WARN mode.
AsrWebShellOnServerAudited	An attack surface reduction rule detected the creation of a webshell on a Windows Server machine.
AsrWebShellOnServerBlocked	An attack surface reduction rule blocked webshell creation activity on a Windows Server machine.
AsrWebShellWarnBypassed	User excluded ASR block for “Block Webshell creation for Servers” rule enabled in WARN mode.
AuditPolicyModification	Changes in the Windows audit policy (which feed events to the event log).
BitLockerAuditCompleted	An audit for BitLocker encryption was completed.
BluetoothPolicyTriggered	A Bluetooth service activity was allowed or blocked by a device control policy.
BrowserLaunchedToOpenUrl	A web browser opened a URL that originated as a link in another application.
BruteForceActivityDetected	Brute-force attempts to sign in were detected by Microsoft Defender for Endpoint.
CertificateServicesApprovedCertificateRequest	Certificate Services approved a certificate request and issued a certificate.
CertificateServicesLoadedTemplate	Certificate Services loaded a certificate template configuration from Active Directory.
CertificateServicesReceivedCertificateRequest	Certificate Services received a certificate request.
ControlFlowGuardViolation	Control Flow Guard terminated an application after detecting an invalid function call
ControlledFolderAccessViolationAudited	Controlled folder access detected an attempt to modify a protected folder.
ControlledFolderAccessViolationBlocked	Controlled folder access blocked an attempt to modify a protected folder.
CreateRemoteThreadApiCall	A thread that runs in the virtual address space of another process was created.
CredentialsBackup	The backup feature in Credential Manager was initiated
DeviceBootAttestationInfo	System Guard generated a boot-time attestation report.
DirectoryServiceObjectCreated	An object was added to the directory service.
DirectoryServiceObjectModified	An object in the directory service was modified.
DnsQueryResponse	A response to a DNS query was sent.
DpapiAccessed	Decription of saved sensitive data encrypted using DPAPI.
DriverLoad	A driver was loaded.
ExploitGuardAcgAudited	Arbitrary code guard (ACG) in exploit protection detected an attempt to modify code page permissions or create unsigned code pages.
ExploitGuardAcgEnforced	Arbitrary code guard (ACG) blocked an attempt to modify code page permissions or create unsigned code pages.
ExploitGuardChildProcessAudited	Exploit protection detected the creation of a child process.
ExploitGuardChildProcessBlocked	Exploit protection blocked the creation of a child process.
ExploitGuardEafViolationAudited	Export address filtering (EAF) in exploit protection detected possible exploitation activity.
ExploitGuardEafViolationBlocked	Export address filtering (EAF) in exploit protection blocked possible exploitation activity.
ExploitGuardIafViolationAudited	Import address filtering (IAF) in exploit protection detected possible exploitation activity.
ExploitGuardIafViolationBlocked	Import address filtering (IAF) in exploit protection blocked possible exploitation activity.
ExploitGuardLowIntegrityImageAudited	Exploit protection detected the launch of a process from a low-integrity file.
ExploitGuardLowIntegrityImageBlocked	Exploit protection blocked the launch of a process from a low-integrity file.
ExploitGuardNetworkProtectionAudited	Network protection detected an attempt to access a malicious or unwanted IP address domain or URL.
ExploitGuardNetworkProtectionBlocked	Network protection blocked a malicious or unwanted IP address domain or URL.
ExploitGuardNonMicrosoftSignedAudited	Exploit protection detected the launch of a process from an image file that is not signed by Microsoft.
ExploitGuardNonMicrosoftSignedBlocked	Exploit protection blocked the launch of a process from an image file that is not signed by Microsoft.
ExploitGuardRopExploitAudited	Exploit protection detected possible return-object programming (ROP) exploitation.
ExploitGuardRopExploitBlocked	Exploit protection blocked possible return-object programming (ROP) exploitation.
ExploitGuardSharedBinaryAudited	Exploit protection detected the launch of a process from a remote shared file.
ExploitGuardSharedBinaryBlocked	Exploit protection blocked the launch of a process from a file in a remote device.
ExploitGuardWin32SystemCallAudited	Exploit protection detected a call to the Windows system API.
ExploitGuardWin32SystemCallBlocked	Exploit protection blocked a call to the Windows system API.
ExternalDeviceConnected	A peripheral connected to this device.
ExternalDeviceDisconnected	A peripheral disconnected from this device.
FileTimestampModificationEvent	File timestamp information was modified.
FirewallInboundConnectionBlocked	A firewall or another application blocked an inbound connection using the Windows Filtering Platform.
FirewallInboundConnectionToAppBlocked	The firewall blocked an inbound connection to an app.
FirewallOutboundConnectionBlocked	A firewall or another application blocked an outbound connection using the Windows Filtering Platform.
FirewallServiceStopped	The firewall service was stopped.
GetAsyncKeyStateApiCall	The GetAsyncKeyState function was called. This function can be used to obtain the states of input keys and buttons.
GetClipboardData	The GetClipboardData function was called. This function can be used obtain the contents of the system clipboard.
LdapSearch	An LDAP search was performed.
LogonRightsSettingEnabled	Interactive logon rights on the machine were granted to a user.
MemoryRemoteProtect	A process has modified the protection mask for a memory region used by another process. This might allow execution of content from non-executable memory.
NamedPipeEvent	A named pipe was created or opened.
NetworkProtectionUserBypassEvent	A user has bypassed network protection and accessed a blocked IP address, domain, or URL.
NetworkShareObjectAccessChecked	A request was made to access a file or folder shared on the network and permissions to the share was evaluated.
NetworkShareObjectAdded	A file or folder was shared on the network.
NetworkShareObjectDeleted	A file or folder shared on the network was deleted.
NetworkShareObjectModified	A file or folder shared on the network was modified.
NtAllocateVirtualMemoryApiCall	Memory was allocated for a process.
NtAllocateVirtualMemoryRemoteApiCall	Memory was allocated for a process remotely.
NtMapViewOfSectionRemoteApiCall	A section of a process’s memory was mapped by calling the function NtMapViewOfSection.
NtProtectVirtualMemoryApiCall	The protection attributes for allocated memory was modified.
OpenProcessApiCall	The OpenProcess function was called indicating an attempt to open a handle to a local process and potentially manipulate that process.
PasswordChangeAttempt	An attempt to change a user password was made.
PlistPropertyModified	A property in the plist was modified.
PnpDeviceAllowed	Device control allowed a trusted plug and play (PnP) device.
PnpDeviceBlocked	Device control blocked an untrusted plug and play (PnP) device.
PnpDeviceConnected	A plug and play (PnP) device was attached.
PowerShellCommand	A PowerShell alias function filter cmdlet external script application script workflow or configuration was executed from a PowerShell host process.
PrintJobBlocked	Device control prevented an untrusted printer from printing.
ProcessCreatedUsingWmiQuery	A process was created using Windows Management Instrumentation (WMI).
ProcessPrimaryTokenModified	A process’s primary token was modified.
PTraceDetected	A process trace (ptrace) was found to have occurred on this device.
QueueUserApcRemoteApiCall	An asynchronous procedure call (APC) was scheduled to execute in a user-mode thread.
ReadProcessMemoryApiCall	The ReadProcessMemory function was called indicating that a process read data from the process memory of another process.
RemoteDesktopConnection	A Remote Desktop connection was established
RemoteWmiOperation	A Windows Management Instrumentation (WMI) operation was initiated from a remote device.
RemovableStorageFileEvent	Removable storage file activity matched a device control removable storage access control policy.
RemovableStoragePolicyTriggered	Device control detected an attempted read/write/execute event from a removable storage device.
SafeDocFileScan	A document was sent to the cloud for analysis while in protected view.
ScheduledTaskCreated	A scheduled task was created.
ScheduledTaskDeleted	A scheduled task was deleted.
ScheduledTaskDisabled	A scheduled task was turned off.
ScheduledTaskEnabled	A scheduled task was turned on.
ScheduledTaskUpdated	A scheduled task was updated.
ScreenshotTaken	A screenshot was taken.
SecurityGroupCreated	A security group was created
SecurityGroupDeleted	A security group was deleted.
SecurityLogCleared	The security log was cleared.
SensitiveFileRead	A file that matched DLP policy was accessed or processes that are reading sensitive files such as ssh keys, Outlook mail archives etc.
ServiceInstalled	A service was installed. This is based on Windows event ID 4697, which requires the advanced security audit setting Audit Security System Extension.
SetThreadContextRemoteApiCall	The context of a thread was set from a user-mode process.
ShellLinkCreateFileEvent	A specially crafted link file (.lnk) was generated. The link file contains unusual attributes that might launch malicious code along with a legitimate file or application.
SmartScreenAppWarning	SmartScreen warned about running a downloaded application that is untrusted or malicious.
SmartScreenExploitWarning	SmartScreen warned about opening a web page that contains an exploit.
SmartScreenUrlWarning	SmartScreen warned about opening a low-reputation URL that might be hosting malware or is a phishing site.
SmartScreenUserOverride	A user has overridden a SmartScreen warning and continued to open an untrusted app or a low-reputation URL.
TamperingAttempt	An attempt to change Microsoft Defender XDR settings was made.
UntrustedWifiConnection	A connection was established to an open Wi-Fi access point that is set to connect automatically.
UsbDriveDriveLetterChanged	The drive letter assigned to a mounted USB storage device was modified
UsbDriveMounted	A USB storage device was mounted as a drive.
UsbDriveUnmounted	A USB storage device was unmounted.
UserAccountAddedToLocalGroup	A user was added to a security-enabled local group.
UserAccountCreated	A local SAM account or a domain account was created.
UserAccountDeleted	A user account was deleted.
UserAccountModified	A user account was modified.
UserAccountPasswordResetAttempt	An attempt was made to reset an account’s password.
UserAccountRemovedFromLocalGroup	A user was removed from a security-enabled local group.
WmiBindEventFilterToConsumer	A filter for WMI events was bound to a consumer. This enables listening for all kinds of system events and triggering corresponding actions, including potentially malicious ones.
WriteToLsassProcessMemory	The WriteProcessMemory function was called indicating that a process has written data into memory for another process.

Schema changes

Date	Action
2026-10-07	Column TimeGenerated added
2026-10-07	Column SourceSystem added
2026-10-07	Column Type added
2026-10-07	Column TenantId added
2026-10-07	Column MachineGroup added
2026-03-23	Action type added: CertificateServicesReceivedCertificateRequest
2026-03-23	Action type added: CertificateServicesLoadedTemplate
2026-03-23	Action type added: CertificateServicesApprovedCertificateRequest
2026-02-27	Column TimeGenerated removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column Type removed
2026-02-27	Column TenantId removed
2026-02-27	Column MachineGroup removed
2026-01-12	Action type added: UserAccountPasswordResetAttempt
2026-01-02	Action type added: ExternalDeviceDisconnected
2026-01-02	Action type added: ExternalDeviceConnected
2024-10-18	Table added to tracking

Known observations

Value casing varies

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.