Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Action

`AdditionalFields`

Submit an example

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "NumberOfSidsInDomainAdminToken": 1,
  "TokenHasDomainAdminSid": false,
  "TokenHasEnterpriseAdminSid": false
}

Payload fields and types

Path	Type
`$`	object
`$.NumberOfSidsInDomainAdminToken`	integer
`$.TokenHasDomainAdminSid`	boolean
`$.TokenHasEnterpriseAdminSid`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsLocalLogon": false,
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.IsLocalLogon`	boolean
`$.Upn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingAccountDomain": "COMPUTERNAME_1",
  "InitiatingAccountName": "USERNAME_1",
  "InitiatingAccountPosixGroupId": 1,
  "InitiatingAccountPosixGroupName": "VALUE_1",
  "InitiatingAccountPosixUserId": 1,
  "PosixPrimaryGroupId": 1,
  "PosixPrimaryGroupName": "VALUE_1",
  "PosixSecondaryGroups": "[]",
  "PosixUserId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingAccountDomain`	string
`$.InitiatingAccountName`	string
`$.InitiatingAccountPosixGroupId`	integer
`$.InitiatingAccountPosixGroupName`	string
`$.InitiatingAccountPosixUserId`	integer
`$.PosixPrimaryGroupId`	integer
`$.PosixPrimaryGroupName`	string
`$.PosixSecondaryGroups`	encoded-json
`$.PosixSecondaryGroups`	string
`$.PosixSecondaryGroups::<json>`	array
`$.PosixUserId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "TokenHasDomainControllerSid": false
}

Payload fields and types

Path	Type
`$`	object
`$.TokenHasDomainControllerSid`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "NumberOfSidsInDomainAdminToken": 1,
  "TokenHasDomainAdminSid": false,
  "TokenHasEnterpriseAdminSid": false,
  "TokenHasGroupPolicyCreatorSid": false,
  "TokenHasSchemaAdminSid": false
}

Payload fields and types

Path	Type
`$`	object
`$.NumberOfSidsInDomainAdminToken`	integer
`$.TokenHasDomainAdminSid`	boolean
`$.TokenHasEnterpriseAdminSid`	boolean
`$.TokenHasGroupPolicyCreatorSid`	boolean
`$.TokenHasSchemaAdminSid`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccessAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsLocalLogon": false
}

Payload fields and types

Path	Type
`$`	object
`$.IsLocalLogon`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "InitiatingAccountDomain": "COMPUTERNAME_1",
  "InitiatingAccountName": "USERNAME_1",
  "InitiatingAccountPosixGroupId": 1,
  "InitiatingAccountPosixGroupName": "VALUE_1",
  "InitiatingAccountPosixUserId": 1,
  "PosixPrimaryGroupId": 1,
  "PosixPrimaryGroupName": "VALUE_1",
  "PosixSecondaryGroups": "[]",
  "PosixUserId": 1,
  "Terminal": "VALUE_2"
}

Payload fields and types

Path	Type
`$`	object
`$.InitiatingAccountDomain`	string
`$.InitiatingAccountName`	string
`$.InitiatingAccountPosixGroupId`	integer
`$.InitiatingAccountPosixGroupName`	string
`$.InitiatingAccountPosixUserId`	integer
`$.PosixPrimaryGroupId`	integer
`$.PosixPrimaryGroupName`	string
`$.PosixSecondaryGroups`	encoded-json
`$.PosixSecondaryGroups`	string
`$.PosixSecondaryGroups::<json>`	array
`$.PosixUserId`	integer
`$.Terminal`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonFailed

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsLocalLogon": false
}

Payload fields and types

Path	Type
`$`	object
`$.IsLocalLogon`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonSuccess

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "TokenHasCertificatePublisherSid": false
}

Payload fields and types

Path	Type
`$`	object
`$.TokenHasCertificatePublisherSid`	boolean

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonFailed

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "IsLocalLogon": false,
  "Upn": "USERNAME_1@example.invalid"
}

Payload fields and types

Path	Type
`$`	object
`$.IsLocalLogon`	boolean
`$.Upn`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: LogonFailedAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

DeviceLogonEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Sign-ins and other authentication events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountSid	Security Identifier (SID) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FailureReason	Information explaining why the recorded action failed	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
IsLocalAdmin	Boolean indicator of whether the user is a local administrator on the machine	Boolean
LogonId	Identifier for a logon session. This identifier is unique on the same machine only between restarts	Int64
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	String
MachineGroup		String
Protocol	Protocol used during the communication	String
RemoteDeviceName	Name of the device that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information.	String
RemoteIP	IP address that was being connected to	String
RemoteIPType	Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast	String
RemotePort	TCP port on the remote device that was being connected to	Int32
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
LogonAttempted	A user attempted to log on to the device.
LogonFailed	A user attempted to logon to the device but failed.
LogonSuccess	A user successfully logged on to the device.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking

Known observations

Value casing varies

Fields: RemoteDeviceName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, AdditionalFields.

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.

DeviceLogonEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		Sign-ins and other authentication events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
AccountDomain	Domain of the account	String
AccountName	User name of the account	String
AccountSid	Security Identifier (SID) of the account	String
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FailureReason	Information explaining why the recorded action failed	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
IsLocalAdmin	Boolean indicator of whether the user is a local administrator on the machine	Boolean
LogonId	Identifier for a logon session. This identifier is unique on the same machine only between restarts	Int64
LogonType	Type of logon session, specifically interactive, remote interactive (RDP), network, batch, and service	String
MachineGroup		String
Protocol	Protocol used during the communication	String
RemoteDeviceName	Name of the device that performed a remote operation on the affected machine. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information.	String
RemoteIP	IP address that was being connected to	String
RemoteIPType	Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast	String
RemotePort	TCP port on the remote device that was being connected to	Int32
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
LogonAttempted	A user attempted to log on to the device.
LogonFailed	A user attempted to logon to the device but failed.
LogonSuccess	A user successfully logged on to the device.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking

Known observations

Value casing varies

Fields: RemoteDeviceName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, AdditionalFields.

Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.

Sources: Olaf Hartong.