Defender-DeviceTvmInfoGatheringKB

ActionTypeTitleSampleRule
anyInformation-gathering knowledge baseYN

any: Information-gathering knowledge base

#
Table
DeviceTvmInfoGatheringKB

Fields #

NameDescription
IgId
FieldName
Description
Categories
DataStructure

Example Event #

{
  "Categories": [
    "network protocol",
    "communication",
    "tls"
  ],
  "Categories@odata.type": "#Collection(String)",
  "DataStructure": "One of the following values: Enabled/Disabled/DisabledByDefault",
  "Description": "Client setting for TLS version 1.0. Can be one of the following: 'Enabled', 'Disabled', 'DisabledByDefault'. See <a href=\"https://docs.microsoft.com/en-us/windows-server/security/tls/tls-registry-settings#tls-dtls-and-ssl-protocol-version-settings\">here</a> for more details",
  "FieldName": "TlsClient10",
  "IgId": "igid-1"
}

References #