Defender-DeviceTvmInfoGathering

ActionTypeTitleSampleRule
anyDevice attack-surface information gatheringYN

any: Device attack-surface information gathering

#
Table
DeviceTvmInfoGathering

Fields #

NameDescription
Timestamp
LastSeenTime
DeviceId
DeviceName
OSPlatform
AdditionalFields
MachineGroup

Example Event #

{
  "AdditionalFields": {
    "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
    "AsrConfigurationStates": {
      "@odata.type": "#microsoft.graph.security.dynamicColumnValue",
      "AdobeReaderChildProcess": "Off",
      "BlockCopiedOrImpersonatedSystemTools": "Off",
      "BlockSafeModeReboot": "Off",
      "BlockWebshellCreation": null,
      "ExecutableEmailContent": "Off",
      "ExecutableOfficeContent": "Off",
      "LsassCredentialTheft": "Off",
      "ObfuscatedScript": "Off",
      "OfficeChildProcess": "Off",
      "OfficeCommAppChildProcess": "Off",
      "OfficeMacroWin32ApiCalls": "Off",
      "OfficeProcessInjection": "Off",
      "PersistenceThroughWmi": "Off",
      "PsexecWmiChildProcess": "Off",
      "Ransomware": "Off",
      "ScriptExecutableDownload": "Off",
      "UntrustedExecutable": "Off",
      "UntrustedUsbProcess": "Off",
      "VulnerableSignedDriver": "Off"
    },
    "AvEnginePublishTime": "2026-07-06T18:54:14.0703200Z",
    "AvEngineRing": "5",
    "AvEngineUpdateTime": "2026-08-01T02:16:49.0000000Z",
    "AvEngineVersion": "1.1.26060.3008",
    "AvIsEngineUptodate": true,
    "AvIsPlatformUptodate": true,
    "AvIsSignatureUptoDate": true,
    "AvMode": "0",
    "AvModeDataRefreshTime": "2026-08-01T07:47:03.0000000Z",
    "AvPlatformExpirationTime": null,
    "AvPlatformPublishTime": "2026-07-06T20:30:52.8625645Z",
    "AvPlatformRing": "5",
    "AvPlatformUpdateTime": "2026-07-17T07:13:37.3103816Z",
    "AvPlatformVersion": "4.18.26060.3008",
    "AvScanResults": {
      "Quick": {
        "ScanStatus": "Completed",
        "ErrorCode": null,
        "Timestamp": "2026-07-22T16:22:24.9762198+00:00"
      },
      "Full": {
        "ScanStatus": "Cancelled",
        "ErrorCode": null,
        "Timestamp": "2026-07-23T05:17:53.6516944+00:00"
      },
      "Custom": null
    },
    "AvSignatureDataRefreshTime": "2026-08-01T07:47:03.0000000Z",
    "AvSignaturePublishTime": "2026-08-01T02:16:49.0000000Z",
    "AvSignatureRing": "5",
    "AvSignatureUpdateTime": "2026-08-01T02:16:49.0000000Z",
    "AvSignatureVersion": "1.455.452.0",
    "Bootiful_Mind_status": "NotFound",
    "CVE_2022_30190_Mitigated": "false",
    "CloudProtectionState": "2",
    "EBPFStatus": null,
    "IsAvEngineLoaded": null,
    "IsWindowsLtscVersionRunning": "false",
    "LocalCveScannerExecuted": null,
    "Log4JEnvironmentVariableMitigation": "false",
    "Log4jLocalScanVulnerable": null,
    "Log4j_CVE_2021_44228": null,
    "SchUseStrongCrypto35": null,
    "SchUseStrongCrypto35Wow6432": null,
    "SchUseStrongCrypto40": null,
    "SchUseStrongCrypto40Wow6432": null,
    "Spring4Shell_CVE_2022_22965": null,
    "SslClient20": null,
    "SslClient30": null,
    "SslServer20": null,
    "SslServer30": null,
    "SystemDefaultTlsVersions35": null,
    "SystemDefaultTlsVersions35Wow6432": null,
    "SystemDefaultTlsVersions40": null,
    "SystemDefaultTlsVersions40Wow6432": null,
    "TlsClient10": null,
    "TlsClient11": null,
    "TlsClient12": null,
    "TlsServer10": null,
    "TlsServer11": null,
    "TlsServer12": null,
    "WdavorHeartbeatEventType": "WdavEvent"
  },
  "DeviceId": "99ffb4eafd9c8fb310527d15d666a58ab4661114",
  "DeviceName": "jd-win11-22h2-1.ludus.domain",
  "LastSeenTime": "2026-08-01T15:13:39Z",
  "OSPlatform": "Windows11",
  "Timestamp": "2026-08-01T16:20:40Z"
}

References #