Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update advanced-hunting-aadsignineventsbeta-table.md #97

Merged
merged 5 commits into from
Dec 11, 2024
Merged

Update advanced-hunting-aadsignineventsbeta-table.md #97

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8118f33
Update advanced-hunting-aadsignineventsbeta-table.md
0xv1n Sep 12, 2024
97ddbd8
Merge branch 'public' into public
schmurky Nov 18, 2024
b1c2c71
Merge branch 'public' into public
schmurky Nov 26, 2024
044199a
Merge branch 'public' into public
schmurky Dec 10, 2024
b2a5ea4
Update advanced-hunting-aadsignineventsbeta-table.md
0xv1n Dec 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions defender-xdr/advanced-hunting-aadsignineventsbeta-table.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ Use this reference to construct queries that return information from the table.
|`NetworkLocationDetails`|`string`|Network location details of the authentication processor of the sign-in event|
|`RequestId`|`string`|Unique identifier of the request|
|`ReportId`|`string`|Unique identifier for the event|
|`EndpointCall`|`string`|Indicates the endpoint called during a login event. Possible values: "Login:reprocess", "Kmsi:kmsi"|
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The description we have in product is: "Information about the Microsoft Entra ID endpoint that the request was sent to and the type of request sent during sign in"

I'm afraid the PM has not replied about possible values, but I will close by end of week in case we get more than the above. Kindly apply the above description for EndpointCall. Thanks for your patience!

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Description updated and removed the possible fields piece since it would be incomplete.


## Related articles

Expand Down