DeviceNetworkInfo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Network properties of devices, including physical adapters, IP and MAC addresses, as well as connected networks and domains

Attribute Value
Category MDE
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Lake-Only Ingestion ✓ Yes
Azure Monitor Tables Reference View Documentation
Defender XDR Advanced Hunting Schema View Documentation

Contents

Schema (22 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
ConnectedNetworks dynamic Networks that the adapter is connected to. Each JSON element in the array contains the network name, category (public, private or domain), a description, and a flag indicating if it is connected publicly to the internet.
DefaultGateways dynamic Default gateway addresses in JSON array format.
DeviceId string Unique identifier for the device in the service.
DeviceName string Fully qualified domain name (FQDN) of the device.
DnsAddresses dynamic DNS server addresses in JSON array format.
IPAddresses dynamic JSON array containing all the IP addresses assigned to the adapter, along with their respective subnet prefix and the IP class (RFC 1918 & RFC 4291).
IPv4Dhcp string IPv4 address of the configured DHCP server.
IPv6Dhcp string IPv6 address of the configured DHCP server.
MacAddress string MAC address of the network adapter.
MachineGroup string The machine-group which this machine is associated to. This group is used by role-based access control to determine access to the machine.
NetworkAdapterName string Name of the network adapter.
NetworkAdapterStatus string Operational status of the network adapter.
NetworkAdapterType string Network adapter type.
NetworkAdapterVendor string Name of the manufacturer or vendor of the network adapter.
ReportId long Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and/or Timestamp columns.
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Date and time the event was recorded by the MDE agent on the endpoint.
TunnelType string Tunneling protocol, when the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH.
Type string The name of the table

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (4)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Microsoft Defender XDR

Content Items Using This Table (22)

Analytic Rules (1)

Standalone Content:

Analytic Rule Selection Criteria
RDP Nesting

Hunting Queries (16)

In solution Hybrid Attack - Cloud & Identity:

Hunting Query Selection Criteria
Azure Network Configuration Tampered by Compromised Identity

Standalone Content:

Hunting Query Selection Criteria
MDE_DeviceInventory-LastUserLoggedIn
Potential rootkit network activity missing from MDE

GitHub Only:

Hunting Query Selection Criteria
Alert Events from Internal IP Address
Baseline Comparison
ConnectedNetworkDeviceDiscovery
Device Logons from Unknown IPs
Devices In Subnet - IPAddressV4
Devices In Subnet - IPAddressV6
Machine info from IP address ConnectedNetworks contains "corp.contoso.com"
DefaultGateways contains "\"
IPv4Dhcp == "10.164.3.12"
NetworkAdapterStatus == "Up"
Machine info from IP address (1)
Machine info from IP address (3) NetworkAdapterStatus == "Up"
Network info of machine NetworkAdapterStatus == "Up"
Seen Connected Networks
Seen IPv4 Network Subnets
Seen IPv6 Network Subnets

Workbooks (5)

In solution Hybrid Attack - Cloud & Identity:

Workbook Selection Criteria
HybridAttack-Cloud&Identity

In solution MaturityModelForEventLogManagementM2131:

Workbook Selection Criteria
MaturityModelForEventLogManagement_M2131

In solution Microsoft Defender XDR:

Workbook Selection Criteria
MicrosoftDefenderForEndPoint

GitHub Only:

Workbook Selection Criteria
MicrosoftDefenderForEndPoint
MicrosoftSentinelDeploymentandMigrationTracker

Parsers Using This Table (2)

Other Parsers (2)

Parser Solution Selection Criteria
AssignedIPAddress MicrosoftDefenderForEndpoint
Devicefromip MicrosoftDefenderForEndpoint

Selection Criteria Summary (2 criteria, 3 total references)

References by type: 0 connectors, 3 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria Connectors Content Items ASIM Parsers Other Parsers Total
NetworkAdapterStatus == "Up" - 2 - - 2
ConnectedNetworks contains "corp.contoso.com"
DefaultGateways contains "\"
IPv4Dhcp == "10.164.3.12"
NetworkAdapterStatus == "Up"		 - 1 - - 1
Total 0 3 0 0 3

ConnectedNetworks

Value Connectors Content Items ASIM Parsers Other Parsers Total
contains corp.contoso.com - 1 - - 1

DefaultGateways

Value Connectors Content Items ASIM Parsers Other Parsers Total
contains \ - 1 - - 1

IPv4Dhcp

Value Connectors Content Items ASIM Parsers Other Parsers Total
10.164.3.12 - 1 - - 1

NetworkAdapterStatus

Value Connectors Content Items ASIM Parsers Other Parsers Total
Up - 3 - - 3

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index