Network properties of machines, including adapters, IP and MAC addresses, as well as connected networks and domains
Defender
Table retention
ColdDays
HotDays
TotalInteractiveDays
0
30
30
Schema
Name
Description
Type
ConnectedNetworks
Networks that the adapter is connected to. Each JSON element in the array contains the network name, category (public, private or domain), a description, and a flag indicating if it’s connected publicly to the internet
String
DefaultGateways
Default gateway addresses in JSON array format
String
DeviceId
Unique identifier for the device in Microsoft Defender for Endpoint
String
DeviceName
Fully qualified domain name (FQDN) of the device
String
DnsAddresses
DNS server addresses in JSON array format
String
IPAddresses
JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and the IP class (RFC 1918 & RFC 4291)
String
IPv4Dhcp
IPv4 address of DHCP server
String
IPv6Dhcp
IPv6 address of DHCP server
String
MacAddress
MAC address of the network adapter
String
MachineGroup
String
NetworkAdapterName
Name of the network adapter
String
NetworkAdapterStatus
Operational status of the network adapter
String
NetworkAdapterType
Network adapter type
String
NetworkAdapterVendor
Name of the manufacturer or vendor of the network adapter
String
ReportId
Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.
Int64
SourceSystem
String
TenantId
String
TimeGenerated
DateTime
Timestamp
Date and time when the record was generated
DateTime
TunnelType
Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH