DeviceTvmSoftwareEvidenceBeta

DeviceTvmSoftwareEvidenceBeta Schema #

Table description #

TableSection	TableType	TableSectionName	Description
Tvm	Regular		Evidence indicating the existence of a software on a device based on registry paths, disk paths, or both.

Table retention #

HotDays	ColdDays	TotalInteractiveDays
30	0	30

Schema #

Name	Description	Type
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DiskPaths	Disk paths on which file level evidence indicating the existence of a software on a device was detected	Object
LastSeenTime	Date and time when the service last saw the device	DateTime
RegistryPaths	Registry paths on which evidence indicating the existence of a software on a device was detected	Object
SoftwareName	Name of the software product	String
SoftwareVendor	Name of the software vendor	String
SoftwareVersion	Version number of the software product	String

Schema changes #

Date	Action
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2024-10-18	Table added to tracking