Supported Microsoft 365 Defender streaming event types in event streaming API

Applies to:


Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

The Event Streaming API is constantly being expanded to support more event types. Learn which Hunting tables are generally available, currently in public preview, or not yet supported. New - Email event types/tables are now GA

Hunting tables support status in Event Streaming API

The following table only includes the list of the tables supported in the streaming API, and is not inclusive of all AH schema. For a full list of the API see, Learn the schema tables.

Table name Status
AlertEvidence GA
AlertInfo GA
DeviceEvents GA
DeviceFileCertificateInfo GA
DeviceFileEvents GA
DeviceImageLoadEvents GA
DeviceInfo GA
DeviceLogonEvents GA
DeviceNetworkEvents GA
DeviceNetworkInfo GA
DeviceProcessEvents GA
DeviceRegistryEvents GA
EmailAttachmentInfo GA
EmailEvents GA
EmailPostDeliveryEvents GA
EmailUrlInfo GA