DataSources and missing docs?

[sirkillnotalot]

Hi all,

I'm probably being dense but I cannot find where these data types are being created, or any documentation on them:

I’m also trying to determine what the ActionType of AntiVirusReport is under the DeviceEvents table:

https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceevents-table... says to check the security.microsoft.com documentation but the AntivirusReport actiontype doesn’t appear in the documen:

Any ideas?

[#2]

@sirkillnotalot The data connectors will show what tables they populate.  I would look through them to see if one of them is creating the tables.

The first one could be from the M365 Security Insights.  Take a look at this blog post: https://techcommunity.microsoft.com/t5/azure-sentinel/microsoft-defender-security-insights-in-azure-...

[#3]

Thanks Gary, that article really helped.

As for the data - yeah it's the MDE connector streaming the data but understanding the actual values is where I'm falling down. None of the documentation actually explains what this particular value actually means. I suspect that it's a detection based off of a scheduled scan but would rather not rely on my assumptions.

I've reached out to the product team to get a steer but not particularly hopefuly.

[#4]

Have you looked at the tables in Defender. Maybe it has better documentation. Or try posting something similar to this post in the Defender group. Someone there may be able to provide better information.