ExposureGraphEdges

Applies to:

• Microsoft Defender XDR
• Microsoft Security Exposure Management (public preview)

Important

Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

The ExposureGraphEdges table in the advanced hunting schema provides visibility into relationships between entities and assets in the enterprise exposure graph. This visibility can help uncover critical organizational assets and explore entity relationships and attack paths. Use this reference to construct queries that return information from this table.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name	Data type	Description
EdgeId	string	Unique identifier for the relationship/edge
EdgeLabel	string	The edge label like "routes traffic to"
SourceNodeId	string	Node ID of the edge's source
SourceNodeName	string	Source node display name
SourceNodeLabel	string	Source node label
SourceNodeCategories	dynamic	Categories list of the source node in JSON format
TargetNodeId	string	Node ID of the edge's target
TargetNodeName	string	Display name of the target node
TargetNodeLabel	string	Target node label
TargetNodeCategories	dynamic	The categories list of the target node in JSON format
EdgeProperties	dynamic	Optional data relevant for the relationship between the nodes in JSON format

Related articles

• Advanced hunting overview
• Learn the query language
• Use shared queries
• Understand the schema
• Apply query best practices
• Query the enterprise exposure graph

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.