Want to experience Microsoft Defender XDR? Learn more about how you can evaluate and pilot Microsoft Defender XDR.

Applies to:

  • Microsoft Defender XDR


Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

The DeviceTvmHardwareFirmware table in the advanced hunting schema contains hardware and firmware information of devices as checked by Microsoft Defender Vulnerability Management. The information includes the system model, processor, and BIOS, among others.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
DeviceId string Unique identifier for the device in the service
DeviceName string Fully qualified domain name (FQDN) of the device
ComponentType string Type of hardware or firmware component
Manufacturer string Manufacturer of hardware or firmware component
ComponentName string Name of hardware or firmware component
ComponentFamily string Component family or class, a grouping of components that have similar features or characteristics as determined by the manufacturer
ComponentVersion string Component version (for example, BIOS version)
AdditionalFields string Additional information about the components in JSON array format

You can try the following sample queries to use the information available in the DeviceTvmHardwareFirmware table:

// Count the number of Lenovo devices
| where ComponentType == "Hardware" and Manufacturer == "lenovo"
| summarize count()
// Find all devices with a specific BIOS version, replace ComponentVersion with what you are looking for
| where ComponentType == "Bios" and ComponentVersion contains "N2VET29W"
|project DeviceId, DeviceName


Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.