DeviceNetworkEvents

DeviceNetworkEvents Schema #

Table description #

TableSection TableType TableSectionName Description
Devices Regular

Table retention #

HotDays ColdDays TotalInteractiveDays
30 0 30

Schema #

Name Description Type
ActionType Type of activity that triggered the event String
AdditionalFields Additional information about the entity or event String
AppGuardContainerId Identifier for the virtualized container used by Application Guard to isolate browser activity String
DeviceId Unique identifier for the device in the service String
DeviceName Fully qualified domain name (FQDN) of the device String
InitiatingProcessAccountDomain Domain of the account that ran the process responsible for the event String
InitiatingProcessAccountName User name of the account that ran the process responsible for the event String
InitiatingProcessAccountObjectId Microsoft Entra object ID of the user account that ran the process responsible for the event String
InitiatingProcessAccountSid Security Identifier (SID) of the account that ran the process responsible for the event String
InitiatingProcessAccountUpn User principal name (UPN) of the account that ran the process responsible for the event String
InitiatingProcessCommandLine Command line used to run the process that initiated the event String
InitiatingProcessCreationTime Date and time when the process that initiated the event was started DateTime
InitiatingProcessFileName Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead String
InitiatingProcessFileSize Size of the process (image file) that initiated the event Int64
InitiatingProcessFolderPath Folder containing the process (image file) that initiated the event String
InitiatingProcessId Process ID (PID) of the process that initiated the event Int64
InitiatingProcessIntegrityLevel Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources. String
InitiatingProcessMD5 MD5 hash of the process (image file) that initiated the event String
InitiatingProcessParentCreationTime Date and time when the parent of the process responsible for the event was started DateTime
InitiatingProcessParentFileName Name of the parent process that spawned the process responsible for the event String
InitiatingProcessParentId Process ID (PID) of the parent process that spawned the process responsible for the event Int64
InitiatingProcessRemoteSessionDeviceName Device name of the remote device from which the initiating process’s RDP session was initiated String
InitiatingProcessRemoteSessionIP IP address of the remote device from which the initiating process’s RDP session was initiated String
InitiatingProcessSessionId Windows session ID of the initiating process Int64
InitiatingProcessSHA1 SHA-1 hash of the process (image file) that initiated the event String
InitiatingProcessSHA256 SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available. String
InitiatingProcessTokenElevation Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event String
InitiatingProcessUniqueId Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices String
InitiatingProcessVersionInfoCompanyName Company name from the version information of the process (image file) responsible for the event String
InitiatingProcessVersionInfoFileDescription Description from the version information of the process (image file) responsible for the event String
InitiatingProcessVersionInfoInternalFileName Internal file name from the version information of the process (image file) responsible for the event String
InitiatingProcessVersionInfoOriginalFileName Original file name from the version information of the process (image file) responsible for the event String
InitiatingProcessVersionInfoProductName Product name from the version information of the process (image file) responsible for the event String
InitiatingProcessVersionInfoProductVersion Product version from the version information of the process (image file) responsible for the event String
IsInitiatingProcessRemoteSession Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false) Boolean
LocalIP IP address assigned to the local machine used during communication String
LocalIPType Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast String
LocalPort TCP port on the local machine used during communication Int32
MachineGroup String
Protocol Protocol used during the communication String
RemoteIP IP address that was being connected to String
RemoteIPType Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast String
RemotePort TCP port on the remote device that was being connected to Int32
RemoteUrl URL or fully qualified domain name (FQDN) that was being connected to String
ReportId Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns. Int64
SourceSystem String
TenantId String
TimeGenerated DateTime
Timestamp Date and time when the record was generated DateTime
Type String

Action types #

Name Description
ConnectionAcknowledged An acknowledgement that a TCP connection was accepted (syn/ack) was made.
ConnectionAttempt An attempt to establish a TCP connection (syn) was made.
ConnectionFailed An attempt to establish a network connection from the device failed.
ConnectionFound An active network connection was found on the device.
ConnectionRequest The device initiated a network connection.
ConnectionSuccess A network connection was successfully established from the device.
DnsConnectionInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected a DNS connection.
FtpConnectionInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected an FTP connection.
HttpConnectionInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected an HTTP connection.
IcmpConnectionInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected an ICMP connection.
InboundConnectionAccepted The device accepted a network connection initiated by another device.
InboundInternetScanInspected An incoming packet from a Microsoft Defender External Attack Surface Management scan was inspected on the device.
ListeningConnectionCreated A process has started listening for connections on a certain port.
NetworkSignatureInspected A packet content was inspected.
NtlmAuthenticationInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected a connection with NTLM authentication.
SmtpConnectionInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SMTP connection.
SshConnectionInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SSH connection.
SslConnectionInspected The deep packet inspection engine in Microsoft Defender for Endpoint inspected an SSL connection.

Schema changes #

Date Action
2024-10-18 Table added to tracking