Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

'where' operator: Failed to resolve table or column expression named 'ProcessCreationEvents'

Copper Contributor

How do i get reference the hunting schema outlined here?


Im unable to use any of the schema table in that article.



3 Replies

@sreeman I can see the tables listed in the article when I go to the Microsoft Defender ATP portal


I don't see them in Azure Sentinel but not really expecting to.

Hi @Gary Bushey , thanks. I know they are part of Defender ATP's db schema, thats why i was wondering if its available on Sentinels DB Schema as well. After all, its just the schema table and not actions.