Microsoft Defender XDR
GeneralAlertInfo
In brief
The documentation now states that AlertInfo can contain Microsoft Sentinel alerts associated with incidents when Sentinel is onboarded to the Defender portal. Data availability depends on deployed Defender services and accessible Sentinel workspaces.
What Defender admins need to know
Administrators should account for Sentinel alert records and workspace availability when building or interpreting AlertInfo queries.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
AlertInfo
Get access
To use advanced hunting or other Microsoft Defender capabilities, you need an appropriate role in Microsoft Entra ID. Read about required roles and permissions for advanced hunting.
This advanced huntingThe AlertInfo table is populated bycontains records from various Microsoft Defender services. If your organization hasn't deployedWhen Microsoft Sentinel is onboarded to the service in Microsoft Defender, queries that useDefender portal, the table aren't going to work or return any results.also contains Microsoft Sentinel alerts associated with incidents. Data availability depends on the services deployed and the Sentinel workspaces you can access. For more information about how to deploy services in Defender, readinformation, see Deploy supported services and Transition your Microsoft Sentinel environment to the Defender portal.
Also, your access to endpoint data is determined by role-based access control (RBAC) settings in Microsoft Defender for Endpoint. Read about managing access to Microsoft Defender.
AlertInfo
The AlertInfo table in the advanced hunting schema contains alert information about alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity.Identity, and onboarded Microsoft Sentinel workspaces. Use this reference to construct queries that return information from this table. Join AlertInfo with AlertEvidence on the AlertId column to retrieve the entities and evidence associated with each alert.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
@@ -12,11 +12,12 @@ ms.collection: ms.custom: - cx-ti - cx-ah+- msecd-doc-authoring-1015 appliesto: - Microsoft Defender XDR - Microsoft Sentinel in the Microsoft Defender portal ms.topic: reference-ms.date: 03/28/2025+ms.date: 08/07/2026 --- # AlertInfo@@ -29,13 +30,13 @@ ms.date: 03/28/2025 ## Get access To use advanced hunting or other [Microsoft Defender](microsoft-365-defender.md) capabilities, you need an appropriate role in Microsoft Entra ID. [Read about required roles and permissions for advanced hunting](custom-roles.md). -This advanced hunting table is populated by records from various Microsoft Defender services. If your organization hasn't deployed the service in Microsoft Defender, queries that use the table aren't going to work or return any results. For more information about how to deploy services in Defender, read [Deploy supported services](deploy-supported-services.md).+The `AlertInfo` table contains records from Microsoft Defender services. When Microsoft Sentinel is onboarded to the Defender portal, the table also contains Microsoft Sentinel alerts associated with incidents. Data availability depends on the services deployed and the Sentinel workspaces you can access. For more information, see [Deploy supported services](deploy-supported-services.md) and [Transition your Microsoft Sentinel environment to the Defender portal](/azure/sentinel/move-to-defender). Also, your access to endpoint data is determined by role-based access control (RBAC) settings in Microsoft Defender for Endpoint. [Read about managing access to Microsoft Defender](m365d-permissions.md). ## AlertInfo -The `AlertInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity. Use this reference to construct queries that return information from this table.+The `AlertInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains alert information from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, Microsoft Defender for Identity, and onboarded Microsoft Sentinel workspaces. Use this reference to construct queries that return information from this table. Join `AlertInfo` with [`AlertEvidence`](advanced-hunting-alertevidence-table.md) on the `AlertId` column to retrieve the entities and evidence associated with each alert. For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).