Defender-DeviceInfo
| ActionType | Title | Sample | Rule |
|---|---|---|---|
| any | Device information | Y | Y |
any: Device information
#Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.
| Name | Rules | Vendors |
|---|---|---|
OnboardingStatus | 2 detection rules | Kusto |
DeviceType | 1 detection rule | Kusto |
MergedToDeviceId | 1 detection rule | Kusto |
OSPlatform | 1 detection rule | Kusto |
Example Event #
{
"AadDeviceId": "ef01b99d-7f4f-4ca5-a03c-956e8fa7f2a1",
"ClientVersion": "10.8821.20348.4893",
"ConnectivityType": "Streamlined",
"DeviceCategory": "Endpoint",
"DeviceId": "ec2cc6b53848cc3454a79df3684465dee27fec8c",
"DeviceName": "jd-dc01-2022.ludus.domain",
"DeviceSubtype": "Server",
"DeviceType": "Server",
"DiscoverySources": {
"Defender for Endpoint": "2026-07-26"
},
"DlpInfo": {
"IsDlpConfigurationValid": false,
"DlpPolicyLastModifiedTimeUTC": null,
"IsDlpEnabled": false,
"IsDefenderRealTimeProtectionEnabled": false,
"IsDefenderBehaviorMonitoringEnabled": false,
"HasDlpACBandwidthExceeded": false,
"HasDlpValidUpn": true,
"DlpUpn": "adminuser@example.onmicrosoft.com"
},
"ExclusionReason": "Other",
"ExposureLevel": "None",
"HardwareUuid": "0c0359a1-063e-4d10-92d2-ef9d69eef244",
"IsAzureADJoined": 0,
"IsAzureADJoined@odata.type": "#SByte",
"IsExcluded": 1,
"IsExcluded@odata.type": "#SByte",
"IsTransient": 0,
"IsTransient@odata.type": "#SByte",
"JoinType": "Domain Joined",
"LoggedOnUsers": [],
"MachineGroup": "a",
"OSArchitecture": "64-bit",
"OSBuild": 20348,
"OSBuild@odata.type": "#Int64",
"OSDistribution": "WindowsServer2022",
"OSPlatform": "WindowsServer2022",
"OSVersion": "10.0",
"OSVersionInfo": "21H2",
"OnboardingStatus": "Onboarded",
"OsBuildRevision": "4893",
"PublicIP": "203.0.113.10",
"ReportId": 639211220300838751,
"ReportId@odata.type": "#Int64",
"SensorHealthState": "Active",
"Timestamp": "2026-07-30T19:09:04.276348Z"
}
Detection Patterns #
1 rule
Stealth: DLL
Exfiltration: Exfiltration Over Physical Medium
Common Indicators #
Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
ProviderName (kusto rule field) | eq | MDATP | 5 rules | kusto |
ProviderName (kusto rule field) | eq | mdatp | 3 rules | kusto |
ActionType (kusto rule field) | eq | LogonSuccess | 1 rule | kusto |
ActionType (kusto rule field) | eq | UsbDriveMounted | 1 rule | kusto |
ActionType (kusto rule field) | ne | ListeningConnectionCreated | 2 rules | kusto |
OnboardingStatus (kusto rule field) | eq | Onboarded | 2 rules | kusto |
OnboardingStatus (kusto rule field) | ne | Onboarded | 2 rules | kusto |
GlobalPrevalence (kusto rule field) | is_null | | 1 rule | kusto |
GlobalPrevalence (kusto rule field) | lt | 200 | 1 rule | kusto |
Image (kusto rule field) | eq | active directory | 1 rule | kusto |
Protocol (kusto rule field) | eq | Kerberos | 1 rule | kusto |
Protocol (kusto rule field) | eq | NTLM | 1 rule | kusto |
RemoteDeviceName (kusto rule field) | is_not_null | | 1 rule | kusto |
RemoteIPType (kusto rule field) | ne | Loopback | 1 rule | kusto |
TargetDomainName (kusto rule field) | in | contoso | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1486T1486T1486