The DeviceTvmInfoGathering table contains Threat & Vulnerability Management assessment events including the status of various configurations and attack surface area states of devices.
Defender
Table retention
ColdDays
HotDays
TotalInteractiveDays
0
30
30
Schema
Name
Description
Type
AdditionalFields
Additional information about the entity or event
Object
DeviceId
Unique identifier for the device in Microsoft Defender for Endpoint
String
DeviceName
Fully qualified domain name (FQDN) of the device
String
LastSeenTime
Date and time when the service last saw the device
DateTime
MachineGroup
String
OSPlatform
Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7