DeviceNetworkEvents
DeviceNetworkEvents contains network connections and related endpoint network activity reported by Microsoft Defender for Endpoint.
tablesCurrent
Relationships
Microsoft Defender for Endpoint
Source productproductMicrosoft Defender for Endpoint P2
Required licenselicenseMicrosoft Graph Security API
API accessapiMicrosoft Defender for Endpoint APIs
API accessapiLegacy Microsoft Defender XDR APIs
API accessapiDeviceProcessEvents
Related tabletableDeviceEvents
Related tabletableDeviceInfo
Related tabletable
Source productproductMicrosoft Defender for Endpoint P2
Required licenselicenseMicrosoft Graph Security API
API accessapiMicrosoft Defender for Endpoint APIs
API accessapiLegacy Microsoft Defender XDR APIs
API accessapiDeviceProcessEvents
Related tabletableDeviceEvents
Related tabletableDeviceInfo
Related tabletable
Schema
| Field | Type | Description | Copy |
|---|---|---|---|
Timestamp | datetime | Date and time when the event was recorded. | |
DeviceId | string | Unique identifier for the device in the service. | |
DeviceName | string | Fully qualified domain name of the device. | |
ActionType | string | Type of network activity that triggered the event. | |
RemoteIP | string | IP address that the device connected to. | |
RemotePort | int | TCP port on the remote device that was connected to. | |
RemoteUrl | string | URL or fully qualified domain name that was connected to. | |
LocalIP | string | Source IP address used during communication. | |
Protocol | string | Protocol used during the communication. | |
InitiatingProcessAccountSid | string | Security identifier of the account that ran the process responsible for the network event. |