Want to experience Microsoft Defender XDR? Learn more about how you can evaluate and pilot Microsoft Defender XDR.

Applies to:

  • Microsoft Defender XDR
  • Microsoft Defender for Endpoint


The DeviceTvmSoftwareEvidenceBeta table is currently in beta. Once it leaves beta, the final table name will change and column names may also change. The modifications will then likely break queries that are still using previous names. Users are advised to review and adjust their queries when this table is finalized.

The DeviceTvmSoftwareEvidenceBeta table in the advanced hunting schema contains data from Microsoft Defender Vulnerability Management related to the software evidence section. This table allows you to view evidence of where a specific software was detected on a device. You can use this table, for example, to identify the file paths of specific software. Use this reference to construct queries that return information from the table.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
DeviceId string Unique identifier for the device in the service
SoftwareVendor string Name of the software publisher
SoftwareName string Name of the software product
SoftwareVersion string Version number of the software product
RegistryPaths dynamic Registry paths where evidence indicating the existence of the software on a device was detected
DiskPaths dynamic Disk paths where file-level evidence indicating the existence of the software on a device was detected
LastSeenTime string Date and time when the device last seen by this service


Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.