4.1.1. Choosing the Right Table
💡 First Principle: Each advanced hunting table records one kind of activity from one family of sensors, with columns designed for that activity. Choosing the table is choosing which question the data can answer, so the first step of every hunt is translating the question's verb ("launched", "connected", "received", "signed in") into a table.
| Question verb | Table | Notable columns |
|---|---|---|
| A process launched | DeviceProcessEvents | FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName |
| A device connected to an address | DeviceNetworkEvents | RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName |
| A file was created, modified, or deleted | DeviceFileEvents | FileName, FolderPath, SHA256, ActionType |
| Someone signed in to a device | DeviceLogonEvents | LogonType, AccountName, RemoteIP |
| A registry value changed | DeviceRegistryEvents | RegistryKey, RegistryValueName, RegistryValueData |
| A DLL was loaded | DeviceImageLoadEvents | FileName, FolderPath, InitiatingProcessFileName |
| Antivirus, ASR, exploit protection, other events | DeviceEvents | ActionType distinguishes event types |
| Device properties (OS, exposure) | DeviceInfo, DeviceNetworkInfo | OSPlatform, DeviceName, IPAddresses |
| An email was delivered | EmailEvents (+ EmailAttachmentInfo, EmailUrlInfo, EmailPostDeliveryEvents) | SenderFromAddress, RecipientEmailAddress, NetworkMessageId, DeliveryAction |
| A user clicked a link | UrlClickEvents | Url, ActionType, AccountUpn |
| AD authentication or directory activity | IdentityLogonEvents, IdentityDirectoryEvents, IdentityQueryEvents | ActionType, AccountName, DestinationDeviceName |
| An Entra ID sign-in | EntraIdSignInEvents, EntraIdSpnSignInEvents | AccountUpn, IPAddress, ErrorCode |
| Activity inside a cloud app | CloudAppEvents | Application, ActionType, AccountObjectId |
| An alert and its evidence | AlertInfo, AlertEvidence | AlertId, Title, EntityType |
| A vulnerability or software inventory | DeviceTvmSoftwareVulnerabilities, DeviceTvmSoftwareInventory | CveId, SoftwareName |
Three schema facts recur. ActionType subdivides most event tables (for example, ConnectionSuccess in DeviceNetworkEvents, LogonFailed in DeviceLogonEvents, AsrOfficeChildProcessBlocked in DeviceEvents), so filtering on it is often the second line of a query. Initiating process columns (InitiatingProcessFileName, InitiatingProcessCommandLine) tell you what caused an event, which is where parent-child anomalies hide. And with Sentinel connected, advanced hunting also shows Sentinel tables (such as SigninLogs, SecurityEvent, CommonSecurityLog) in the schema, queried with TimeGenerated rather than Timestamp.
XDR data in advanced hunting covers the last 30 days. Longer history requires the table to be retained in Sentinel (2.1.2) and queried there.
⚠️ Exam Trap: "Find which process on a device made outbound connections to a known C2 domain" uses DeviceNetworkEvents filtered on RemoteUrl and reading InitiatingProcessFileName, not DeviceProcessEvents (no network columns) and not DeviceEvents.
Reflection Question: A threat report says attackers delivered a malicious ISO attachment, which users mounted to run an LNK file that started PowerShell. Name the table you'd query for each of the three stages, and the column that links each stage to the next.
