Include missing ActionTypes in DeviceEvents

Copper Contributor

Hi all,


There is a discrepancy between those events with certain ActionTypes that are viewable in the timeline view of a device, and those able to be searched in Advanced Hunting in KQL - this means no custom detections can be made, and threatening based on them is not possible.

This article lists 61 events that are missing in the DeviceEvent table:


Please can this data be included?


Kind regards,


1 Reply
Discrepancies are still in place today. Any reports of this getting fixed/added?