Edit

Share via

Supported Microsoft Defender XDR streaming event types in event streaming API

  • Article

Applies to:

Note

Try our new APIs using MS Graph security API. Find out more at: Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn.

Important

Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.

The Event Streaming API is constantly being expanded to support more event types. Learn which hunting tables are generally available, currently in public preview, or not yet supported.

Hunting tables support status in Event Streaming API

The following table only includes the list of the tables supported in the streaming API, and is not inclusive of all AH schema. For a full list of the API see, Learn the schema tables.

Note

Streaming data is only available for columns or fields that are in general availability in Microsoft Defender XDR.

Table name Status
(Commercial)		 GCC GCC High DoD
AlertEvidence GA GA GA GA
AlertInfo GA GA GA GA
DeviceEvents GA GA GA GA
DeviceFileCertificateInfo GA GA GA GA
DeviceFileEvents GA GA GA GA
DeviceImageLoadEvents GA GA GA GA
DeviceInfo GA GA GA GA
DeviceLogonEvents GA GA GA GA
DeviceNetworkEvents GA GA GA GA
DeviceNetworkInfo GA GA GA GA
DeviceProcessEvents GA GA GA GA
DeviceRegistryEvents GA GA GA GA
EmailAttachmentInfo GA GA GA GA
EmailEvents GA GA GA GA
EmailPostDeliveryEvents GA GA GA GA
EmailUrlInfo GA GA GA GA
IdentityLogonEvents GA GA GA GA
IdentityQueryEvents GA GA GA GA
IdentityDirectoryEvents GA GA GA GA
CloudAppEvents GA GA GA GA
UrlClickEvents Public preview Not available Not available Not available

Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.