Azure Defender for Endpoint Tables

Tables

Onboarded endpoint devices reported by Microsoft Defender for Endpoint. One row per machine per configuration.

Name	Type	Description
ConfigID	integer	Internal configuration/sync identifier for this record.
DefenderMachineID	string	MDE machine identifier (40-character hex string from the API id field).
ComputerDnsName	string	Fully qualified DNS hostname of the device.
FirstSeen	datetime	Timestamp when the machine was first observed by MDE.
LastSeen	datetime	Timestamp of the most recent activity or heartbeat from the machine.
OsPlatform	string	Operating system platform (e.g., `Windows10`, `Windows11`, `WindowsServer2019`).
OsVersion	string	Operating system version or feature update identifier (e.g., `22H2`).
OsProcessor	string	Processor architecture string reported by the OS.
Version	string	OS build version string reported by the machine.
LastIpAddress	string	Last known internal IP address of the machine.
LastExternalIpAddress	string	Last known external/public IP address of the machine.
AgentVersion	string	Version of the MDE sensor agent installed on the machine.

Catalog of distinct software products known to MDE across the tenant. One row per software product per configuration.

Name	Type	Description
ConfigID	integer	Internal configuration/sync identifier for this record.
DefenderSoftwareID	string	MDE software identifier in `vendor-_-product` format (e.g., `microsoft-_-edge_chromium-based`).
Name	string	Display name of the software product.
Vendor	string	Name of the software vendor.
Weaknesses	integer	Number of known vulnerabilities (CVEs) affecting this software.
PublicExploit	boolean	Whether any vulnerability in this software has a publicly available exploit.
ActiveAlert	boolean	Whether any active security alert is associated with this software.
ExposedMachines	integer	Number of machines in the tenant exposed through this software.
ImpactScore	float	Numeric score representing the security impact of this software across the tenant.
IsNormalized	boolean	Whether MDE has normalized the software name and version for consistency.
Category	string	Software category (e.g., `Application`, `OperatingSystem`, `SecurityTool`).
DistributionsJson	string	JSON array of version distribution objects showing installed versions across machines.
BatchDate	datetime	Timestamp when this record was ingested into the data warehouse.

Fact table linking machines to the software products installed on them. One row per machine-software pair per configuration.

Name	Type	Description
ConfigID	integer	Internal configuration/sync identifier for this record.
DefenderMachineID	string	Foreign key to `AzureADDefenderMachines` identifying the machine.
DefenderSoftwareID	string	Foreign key to `AzureADDefenderSoftwareInventory` identifying the software product.
Name	string	Display name of the installed software product.
Vendor	string	Name of the software vendor.
BatchDate	datetime	Timestamp when this record was ingested into the data warehouse.

CVE/vulnerability catalog known to MDE. One row per vulnerability per configuration. Synced incrementally by updatedOn timestamp.

Name	Type	Description
ConfigID	integer	Internal configuration/sync identifier for this record.
DefenderVulnerabilityID	string	MDE vulnerability identifier, typically the CVE number (e.g., `CVE-2021-44228`).
Name	string	Display name of the vulnerability, usually the CVE identifier.
Description	string	Full text description of the vulnerability and its impact.
Severity	string	Severity rating (`Critical`, `High`, `Medium`, `Low`).
CvssV3	float	CVSS v3.x base score (`0.0` to `10.0`).
ExposedMachines	integer	Number of machines in the tenant exposed to this vulnerability.
PublishedOn	datetime	Date the vulnerability was publicly disclosed.
UpdatedOn	datetime	Date the vulnerability record was last updated by MDE. Used as the watermark for incremental sync.
PublicExploit	boolean	Whether a publicly available exploit exists for this vulnerability.
ExploitVerified	boolean	Whether MDE has verified the exploit is functional.
ExploitInKit	boolean	Whether the exploit has been observed in an exploit kit.
ExploitTypesSerialized	string	JSON array of exploit type strings (e.g., `Local privilege escalation`, `Denial of service`, `Remote code execution`).
ExploitUrisSerialized	string	JSON array of URIs to public exploit references.
CveSupportability	string	Whether MDE supports remediation tracking for this CVE (`Supported`, `NotSupported`, `SupportedInPremium`).
Tags	string	JSON array of tags applied to the vulnerability by MDE.
BatchDate	datetime	Timestamp when this record was ingested into the data warehouse.

Exposure fact table linking a machine, a software product, and a CVE. One row per machine-software-vulnerability combination per configuration.

Name	Type	Description
ConfigID	integer	Internal configuration/sync identifier for this record.
RecordID	string	Composite record identifier in the format `machineId-_-cveId-_-softwareId-_-version-_-`, synthesized from the API response.
DefenderMachineID	string	Foreign key to AzureADDefenderMachines identifying the exposed machine.
DefenderSoftwareID	string	Foreign key to AzureADDefenderSoftwareInventory identifying the affected software.
DefenderVulnerabilityID	string	Foreign key to AzureADDefenderVulnerabilities identifying the CVE.
ProductVersion	string	Version of the software installed on the machine that is affected by this vulnerability.
Severity	string	Severity of the vulnerability on this specific machine (`Critical`, `High`, `Medium`, `Low`).
CvssV3	float	CVSS v3.x base score for the vulnerability (`0.0` to `10.0`).
SecurityUpdateAvailable	string	Whether a security update is available to remediate the vulnerability (`True`, `False`).
FixingKbId	string	Microsoft Knowledge Base article ID for the fixing patch (e.g., `KB5034441`), null if no patch available.
FirstSeenTimestamp	datetime	Timestamp when this vulnerability was first detected on this machine.
LastSeenTimestamp	datetime	Timestamp of the most recent detection of this vulnerability on this machine.
BatchDate	datetime	Timestamp when this record was ingested into the data warehouse.

Threat and vulnerability management security recommendations from MDE. One row per recommendation per configuration.

Name	Type	Description
ConfigID	integer	Internal configuration/sync identifier for this record.
DefenderSecurityRecommendationID	string	MDE recommendation identifier in `va-_-vendor-_-product` format (e.g., `va-_-microsoft-_-edge_chromium-based`).
ProductName	string	Name of the software product the recommendation applies to.
RecommendationName	string	Human-readable title describing the recommended action.
Weaknesses	integer	Number of CVEs associated with this recommendation.
Vendor	string	Vendor of the software product the recommendation applies to.
RecommendedVersion	string	Target software version that resolves the recommendation.
RecommendedProgram	string	Name of the recommended replacement program if different from the current one.
RecommendedVendor	string	Vendor of the recommended replacement program.
RecommendationCategory	string	Category of the recommendation (`Application`, `OS`, `SecurityControls`, `Network`, `Accounts`).
SubCategory	string	Subcategory providing additional classification detail.
SeverityScore	float	Numeric severity score for the recommendation (higher is more urgent).