← Browse all tablesLoading table information…
Contribute structured examples for this table using the PowerShell tool. Submit a synthetic example.
DeviceTvmSoftwareEvidenceBeta Schema
Table description
| TableSection |
TableType |
TableSectionName |
Description |
Source |
| Tvm |
Regular |
|
Evidence indicating the existence of a software on a device based on registry paths, disk paths, or both. |
Defender |
Table retention
| ColdDays |
HotDays |
TotalInteractiveDays |
| 0 |
30 |
30 |
Schema
| Name |
Description |
Type |
| DeviceId |
Unique identifier for the device in Microsoft Defender for Endpoint |
String |
| DiskPaths |
Disk paths on which file level evidence indicating the existence of a software on a device was detected |
Object |
| LastSeenTime |
Date and time when the service last saw the device |
DateTime |
| MachineGroup |
|
String |
| RegistryPaths |
Registry paths on which evidence indicating the existence of a software on a device was detected |
Object |
| SoftwareName |
Name of the software product |
String |
| SoftwareVendor |
Name of the software vendor |
String |
| SoftwareVersion |
Version number of the software product |
String |
| SourceSystem |
|
String |
| TenantId |
|
String |
| Type |
|
String |
Schema changes
| Date |
Action |
| 2026-10-07 |
Column TenantId added |
| 2026-10-07 |
Column Type added |
| 2026-10-07 |
Column SourceSystem added |
| 2026-10-07 |
Column MachineGroup added |
| 2026-02-27 |
Column TenantId removed |
| 2026-02-27 |
Column Type removed |
| 2026-02-27 |
Column SourceSystem removed |
| 2026-02-27 |
Column MachineGroup removed |
| 2024-10-18 |
Table added to tracking |