Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
The DeviceTvmSoftwareEvidenceBeta table is currently in beta. Once it leaves beta, the final table name changes and column names might also change. The modifications are likely to break queries that are still using previous names. Users are advised to review and adjust their queries when this table is finalized.
The DeviceTvmSoftwareEvidenceBeta table in the advanced hunting schema contains data from Microsoft Defender Vulnerability Management related to the software evidence section. This table allows you to view evidence of where a specific software was detected on a device. You can use this table, for example, to identify the file paths of specific software. Use this reference to construct queries that return information from the table.
Microsoft Defender for Endpoint data populates this advanced hunting table. If your organization didn't deploy the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Endpoint in Defender XDR, read Deploy supported services.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
| Column name | Data type | Description |
|---|---|---|
DeviceId |
string |
Unique identifier for the device in the service |
SoftwareVendor |
string |
Name of the software publisher |
SoftwareName |
string |
Name of the software product |
SoftwareVersion |
string |
Version number of the software product |
RegistryPaths |
dynamic |
Registry paths where evidence indicating the existence of the software on a device was detected |
DiskPaths |
dynamic |
Disk paths where file-level evidence indicating the existence of the software on a device was detected |
LastSeenTime |
string |
Date and time when the device was last seen by this service |