DeviceEvents
Applies to:
- Microsoft Defender XDR
- Microsoft Defender for Endpoint
The miscellaneous device events or DeviceEvents
table in the advanced hunting schema contains information about various event types, including events triggered by security controls, such as Microsoft Defender Antivirus and exploit protection. Use this reference to construct queries that return information from this table.
Tip
For detailed information about the events types (ActionType
values) supported by a table, use the built-in schema reference available in Microsoft Defender XDR.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
Column name | Data type | Description |
---|---|---|
Timestamp |
datetime |
Date and time when the event was recorded |
DeviceId |
string |
Unique identifier for the device in the service |
DeviceName |
string |
Fully qualified domain name (FQDN) of the device |
ActionType |
string |
Type of activity that triggered the event. See the in-portal schema reference for details. |
FileName |
string |
Name of the file that the recorded action was applied to |
FolderPath |
string |
Folder containing the file that the recorded action was applied to |
SHA1 |
string |
SHA-1 of the file that the recorded action was applied to |
SHA256 |
string |
SHA-256 of the file that the recorded action was applied to. This field is usually not populated — use the SHA1 column when available. |
MD5 |
string |
MD5 hash of the file that the recorded action was applied to |
FileSize |
long |
Size of the file in bytes |
AccountDomain |
string |
Domain of the account |
AccountName |
string |
User name of the account; if the device is registered in Microsoft Entra ID, the Entra ID user name of the account might be shown instead |
AccountSid |
string |
Security Identifier (SID) of the account |
RemoteUrl |
string |
URL or fully qualified domain name (FQDN) that was being connected to |
RemoteDeviceName |
string |
Name of the device that performed a remote operation on the affected device. Depending on the event being reported, this name could be a fully-qualified domain name (FQDN), a NetBIOS name, or a host name without domain information. |
ProcessId |
long |
Process ID (PID) of the newly created process |
ProcessCommandLine |
string |
Command line used to create the new process |
ProcessCreationTime |
datetime |
Date and time the process was created |
ProcessTokenElevation |
string |
Indicates the type of token elevation applied to the newly created process. Possible values: TokenElevationTypeLimited (restricted), TokenElevationTypeDefault (standard), and TokenElevationTypeFull (elevated) |
LogonId |
long |
Identifier for a logon session. This identifier is unique on the same device only between restarts. |
RegistryKey |
string |
Registry key that the recorded action was applied to |
RegistryValueName |
string |
Name of the registry value that the recorded action was applied to |
RegistryValueData |
string |
Data of the registry value that the recorded action was applied to |
RemoteIP |
string |
IP address that was being connected to |
RemotePort |
int |
TCP port on the remote device that was being connected to |
LocalIP |
string |
IP address assigned to the local device used during communication |
LocalPort |
int |
TCP port on the local device used during communication |
FileOriginUrl |
string |
URL where the file was downloaded from |
FileOriginIP |
string |
IP address where the file was downloaded from |
InitiatingProcessSHA1 |
string |
SHA-1 of the process (image file) that initiated the event |
InitiatingProcessSHA256 |
string |
SHA-256 of the process (image file) that initiated the event. This field is usually not populated — use the SHA1 column when available. |
InitiatingProcessMD5 |
string |
MD5 hash of the process (image file) that initiated the event |
InitiatingProcessFileName |
string |
Name of the process that initiated the event |
InitiatingProcessFileSize |
long |
Size of the file that ran the process responsible for the event |
InitiatingProcessFolderPath |
string |
Folder containing the process (image file) that initiated the event |
InitiatingProcessId |
long |
Process ID (PID) of the process that initiated the event |
InitiatingProcessCommandLine |
string |
Command line used to run the process that initiated the event |
InitiatingProcessCreationTime |
datetime |
Date and time when the process that initiated the event was started |
InitiatingProcessAccountDomain |
string |
Domain of the account that ran the process responsible for the event |
InitiatingProcessAccountName |
string |
User name of the account that ran the process responsible for the event; if the device is registered in Microsoft Entra ID, the Entra ID user name of the account that ran the process responsible for the event might be shown instead |
InitiatingProcessAccountSid |
string |
Security Identifier (SID) of the account that ran the process responsible for the event |
InitiatingProcessAccountUpn |
string |
User principal name (UPN) of the account that ran the process responsible for the event; if the device is registered in Microsoft Entra ID, the Entra ID UPN of the account that ran the process responsible for the event might be shown instead |
InitiatingProcessAccountObjectId |
string |
Microsoft Entra object ID of the user account that ran the process responsible for the event |
InitiatingProcessVersionInfoCompanyName |
string |
Company name from the version information of the process (image file) responsible for the event |
InitiatingProcessVersionInfoProductName |
string |
Product name from the version information of the process (image file) responsible for the event |
InitiatingProcessVersionInfoProductVersion |
string |
Product version from the version information of the process (image file) responsible for the event |
InitiatingProcessVersionInfoInternalFileName |
string |
Internal file name from the version information of the process (image file) responsible for the event |
InitiatingProcessVersionInfoOriginalFileName |
string |
Original file name from the version information of the process (image file) responsible for the event |
InitiatingProcessVersionInfoFileDescription |
string |
Description from the version information of the process (image file) responsible for the event |
InitiatingProcessParentId |
long |
Process ID (PID) of the parent process that spawned the process responsible for the event |
InitiatingProcessParentFileName |
string |
Name or full path of the parent process that spawned the process responsible for the event |
InitiatingProcessParentCreationTime |
datetime |
Date and time when the parent of the process responsible for the event was started |
InitiatingProcessLogonId |
long |
Identifier for a logon session of the process that initiated the event. This identifier is unique on the same device only between restarts. |
ReportId |
long |
Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns. |
AppGuardContainerId |
string |
Identifier for the virtualized container used by Application Guard to isolate browser activity |
AdditionalFields |
string |
Additional information about the event in JSON array format |
Related topics
- Advanced hunting overview
- Learn the query language
- Use shared queries
- Hunt across devices, emails, apps, and identities
- Understand the schema
- Apply query best practices
Tip
Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.