Microsoft Defender XDR
Hunting and detectionAdvanced Hunting Devicebaselinecomplianceassessmentkb Table
In brief
The documentation now specifies that `ConfigurationId` is identified within a benchmark and benchmark version, and documents the `ConfigurationBenchmarkVersion` field.
What Defender admins need to know
Administrators can more accurately interpret configuration records and the benchmark version associated with each configuration.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Column name | Data type | Description |
|---|---|---|
ConfigurationId |
string |
|
ConfigurationName |
string |
Display name of the configuration |
ConfigurationDescription |
string |
Description of the configuration |
ConfigurationRationale |
string |
Description of any associated risks and rationale behind the configuration |
CCEReference |
string |
Unique Common Configuration Enumeration (CCE) identifier for the configuration |
RemediationOptions |
string |
Recommended actions to reduce or address any associated risks |
ConfigurationBenchmark |
string |
Industry benchmark recommending the configuration |
ConfigurationBenchmarkVersion | string | Version of the industry benchmark recommending the configuration |
Source |
dynamic |
The registry path or other location used to determine the current device setting |
RecommendedValue |
dynamic |
Set of expected values for the current device setting to be compliant |
@@ -37,7 +37,7 @@ For information on other tables in the advanced hunting schema, see [the advance | Column name | Data type | Description | |-------------|-----------|-------------|-| `ConfigurationId` | `string` | Unique identifier for a specific configuration |+| `ConfigurationId` | `string` | Identifier for a configuration within a specific benchmark and benchmark version | | `ConfigurationName` | `string` | Display name of the configuration | | `ConfigurationDescription` | `string` | Description of the configuration | | `ConfigurationRationale` | `string` | Description of any associated risks and rationale behind the configuration |@@ -46,6 +46,7 @@ For information on other tables in the advanced hunting schema, see [the advance | `CCEReference` | `string` | Unique Common Configuration Enumeration (CCE) identifier for the configuration | | `RemediationOptions` | `string` | Recommended actions to reduce or address any associated risks | | `ConfigurationBenchmark` | `string` | Industry benchmark recommending the configuration |+| `ConfigurationBenchmarkVersion` | `string` | Version of the industry benchmark recommending the configuration | | `Source` | `dynamic` | The registry path or other location used to determine the current device setting | | `RecommendedValue` | `dynamic` | Set of expected values for the current device setting to be compliant |