Defender-DeviceInfo

ActionTypeTitleSampleRule
anyDevice informationYY

any: Device information

#
Table
DeviceInfo

Fields #

NameDescriptionRules
Timestamp
DeviceId
DeviceName
ClientVersion
PublicIP
OSArchitecture
OSPlatform
OSBuild
OSVersion
IsAzureADJoined
JoinType
AadDeviceId
LoggedOnUsers
MachineGroup
ReportId
OnboardingStatus1 detection rule
DeviceCategory
DeviceType
IsInternetFacing
SensorHealthState1 detection rule
ExposureLevel
AdditionalFields

Example Event #

{
  "AadDeviceId": "ef01b99d-7f4f-4ca5-a03c-956e8fa7f2a1",
  "ClientVersion": "10.8821.20348.4893",
  "ConnectivityType": "Streamlined",
  "DeviceCategory": "Endpoint",
  "DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
  "DeviceName": "jd-dc01-2022.ludus.domain",
  "DeviceSubtype": "Server",
  "DeviceType": "Server",
  "DiscoverySources": {
    "Defender for Endpoint": "2026-07-26"
  },
  "DlpInfo": {
    "IsDlpConfigurationValid": false,
    "DlpPolicyLastModifiedTimeUTC": null,
    "IsDlpEnabled": false,
    "IsDefenderRealTimeProtectionEnabled": false,
    "IsDefenderBehaviorMonitoringEnabled": false,
    "HasDlpACBandwidthExceeded": false,
    "HasDlpValidUpn": true,
    "DlpUpn": "adminuser@example.onmicrosoft.com"
  },
  "ExclusionReason": "Other",
  "ExposureLevel": "None",
  "HardwareUuid": "0c0359a1-063e-4d10-92d2-ef9d69eef244",
  "IsAzureADJoined": 0,
  "IsAzureADJoined@odata.type": "#SByte",
  "IsExcluded": 1,
  "IsExcluded@odata.type": "#SByte",
  "IsTransient": 0,
  "IsTransient@odata.type": "#SByte",
  "JoinType": "Domain Joined",
  "LoggedOnUsers": [],
  "MachineGroup": "a",
  "OSArchitecture": "64-bit",
  "OSBuild": 20348,
  "OSBuild@odata.type": "#Int64",
  "OSDistribution": "WindowsServer2022",
  "OSPlatform": "WindowsServer2022",
  "OSVersion": "10.0",
  "OSVersionInfo": "21H2",
  "OnboardingStatus": "Onboarded",
  "OsBuildRevision": "4893",
  "PublicIP": "203.0.113.10",
  "ReportId": 639211220300838751,
  "ReportId@odata.type": "#Int64",
  "SensorHealthState": "Active",
  "Timestamp": "2026-07-30T19:09:04.276348Z"
}

Detection Patterns #

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
ProviderName (kusto rule field)eqMDATP5 ruleskusto
ProviderName (kusto rule field)eqmdatp3 ruleskusto
ActionType (kusto rule field)eqLogonSuccess1 rulekusto
ActionType (kusto rule field)eqUsbDriveMounted1 rulekusto
ActionType (kusto rule field)neListeningConnectionCreated2 ruleskusto
OnboardingStatus (kusto rule field)eqOnboarded2 ruleskusto
OnboardingStatus (kusto rule field)neOnboarded2 ruleskusto
GlobalPrevalence (kusto rule field)is_null1 rulekusto
GlobalPrevalence (kusto rule field)lt2001 rulekusto
Image (kusto rule field)eqactive directory1 rulekusto
Protocol (kusto rule field)eqKerberos1 rulekusto
Protocol (kusto rule field)eqNTLM1 rulekusto
RemoteDeviceName (kusto rule field)is_not_null1 rulekusto
RemoteIPType (kusto rule field)neLoopback1 rulekusto
TargetDomainName (kusto rule field)incontoso1 rulekusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

  • AV detections related to Dev-0530 actors source high: This query looks for Microsoft Defender AV detections related to Dev-0530 actors. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.T1486
  • AV detections related to Europium actors source high: This query looks for Microsoft Defender AV detections related to Europium actor. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available. Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-governmentT1486
  • AV detections related to Hive Ransomware source high: This query looks for Microsoft Defender AV detections related to Hive Ransomware. In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, logged on users etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.T1486

References #