Advanced hunting schema: DeviceProcessEvents, DeviceNetworkEvents, DeviceLogonEvents, EmailEvents, EmailUrlInfo, IdentityLogonEvents, CloudAppEvents, AlertInfo and AlertEvidence

Advanced hunting in the Defender portal exposes Defender XDR data as tables grouped by source. Knowing which table holds which kind of event, and how tables link, is the difference between a quick hunt and a frustrating one. The schema reference in the portal, on the left side of the advanced hunting page, lists every table and column with descriptions and sample queries. The time column in these tables is Timestamp, and advanced hunting keeps about 30 days of Defender data; for longer history, the data must be in Sentinel or the data lake. Device tables come from Defender for Endpoint. DeviceProcessEvents records process creation: FileName, FolderPath, ProcessCommandLine, the SHA256 hash, the account, and the parent through the InitiatingProcess columns such as InitiatingProcessFileName and InitiatingProcessCommandLine. It is where you hunt for encoded PowerShell, living-off-the-land binaries or Office apps spawning shells. DeviceNetworkEvents records network connections: RemoteIP, RemotePort, RemoteUrl, the ActionType (for example ConnectionSuccess or ConnectionFailed) and the initiating process. DeviceLogonEvents records logons to devices, with AccountName, LogonType (such as Interactive, Network or RemoteInteractive) and ActionType showing success or failure. Other device tables cover files (DeviceFileEvents), registry (DeviceRegistryEvents), images loaded and general events (DeviceEvents). The ActionType column appears in most tables and describes what kind of event each row is, so running summarize count() by ActionType is a good first step with any unfamiliar table.