Skip to content

Latest commit

 

History

History
76 lines (64 loc) · 4.61 KB

advanced-hunting-devicetvmsecureconfigurationassessment-table.md

File metadata and controls

76 lines (64 loc) · 4.61 KB
Raw
title description search.appverid ms.service ms.subservice f1.keywords ms.author author ms.localizationpriority manager audience ms.collection ms.custom ms.topic ms.date
DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema
Learn about security assessment events in the DeviceTvmSecureConfigurationAssessment table of the advanced hunting schema. These events provide device information, security configuration details, impact, and compliance information.
met150
defender-xdr
adv-hunting
NOCSH
maccruz
schmurky
medium
dansimp
ITPro
m365-security
tier3
cx-ti
cx-ah
reference
01/16/2024

DeviceTvmSecureConfigurationAssessment

[!INCLUDE Microsoft Defender XDR rebranding]

Applies to:

  • Microsoft Defender XDR
  • Microsoft Defender for Endpoint

Each row in the DeviceTvmSecureConfigurationAssessment table contains an assessment event for a specific security configuration from Microsoft Defender Vulnerability Management. Use this reference to check the latest assessment results and determine whether devices are compliant.

You can join this table with the DeviceTvmSecureConfigurationAssessmentKB table using ConfigurationId so you can, for example, view the text description of the configuration from the ConfigurationDescription column of the DeviceTvmSecureConfigurationAssessmentKB table, in the configuration assessment results.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
DeviceId string Unique identifier for the device in the service
DeviceName string Fully qualified domain name (FQDN) of the device
OSPlatform string Platform of the operating system running on the device. Indicates specific operating systems, including variations within the same family, such as Windows 11, Windows 10, and Windows 7.
Timestamp datetime Date and time when the record was generated
ConfigurationId string Unique identifier for a specific configuration
ConfigurationCategory string Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls
ConfigurationSubcategory string Subcategory or subgrouping to which the configuration belongs. In many cases, string describes specific capabilities or features.
ConfigurationImpact real Rated impact of the configuration to the overall configuration score (1-10)
IsCompliant boolean Indicates whether the configuration or policy is properly configured
IsApplicable boolean Indicates whether the configuration or policy applies to the device
Context dynamic Additional contextual information about the configuration or policy
IsExpectedUserImpact boolean Indicates whether there will be user impact if the configuration or policy is applied

You can try this example query to return information on devices with non-compliant antivirus configurations along with the relevant configuration metadata from the DeviceTvmSecureConfigurationAssessmentKB table:

// Get information on devices with antivirus configurations issues
DeviceTvmSecureConfigurationAssessment
| where ConfigurationSubcategory == 'Antivirus' and IsApplicable == 1 and IsCompliant == 0
| join kind=leftouter (
    DeviceTvmSecureConfigurationAssessmentKB
    | project ConfigurationId, ConfigurationName, ConfigurationDescription, RiskDescription, Tags, ConfigurationImpact
) on ConfigurationId
| project DeviceName, OSPlatform, ConfigurationId, ConfigurationName, ConfigurationCategory, ConfigurationSubcategory, ConfigurationDescription, RiskDescription, ConfigurationImpact, Tags

Related topics