@@ -19,16 +19,13 @@ ms.topic: reference ms.date: 03/28/2025 --- -# DataSecurityEvents (Preview)+# DataSecurityEvents  [!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]    -> [!IMPORTANT]-> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.- The `DataSecurityEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about user activities that violate user-defined or default policies in the Microsoft Purview suite of solutions. Each log represents a single user activity enriched with proprietary Microsoft detections (like sensitive info types) and user-defined enrichment labels like domain categories, sensitivity labels, and others.  This advanced hunting table is populated by records from Microsoft Purview Insider Risk Management. If your organization hasn't opted in to share insider risk alerts with Microsoft Defender, queries that use the table aren't going to work or return any results. For more information, read [Investigate insider risk threats](irm-investigate-alerts-defender.md).@@ -39,20 +36,22 @@ Use this reference to construct queries that return information from this table. |-------------|-----------|-------------| |`ApplicationNames`|	`string`|List of application names used or related to the event| |`DeviceId`|	`string`|	Unique identifier for the device in Microsoft Defender for Endpoint|-|`DeviceName`|	`string`|	Fully qualified domain name(FQDN) of the device|+|`DeviceName`|	`string`|	Fully qualified domain name (FQDN) of the device| |`AadDeviceId`|	`guid`|	Unique identifier for the device in Microsoft Entra ID| |`IsManagedDevice`|	`bool`| Indicates if the device is managed by the organization (True) or not (False)| |`DlpPolicyMatchInfo`|	`string`|	Information around the list of data loss prevention (DLP) policies matching this event| |`DlpPolicyEnforcementMode`|	`int`|	Indicates the Data Loss Prevention policy that was enforced; value can be: 0 (None), 1 (Audit), 2 (Warn), 3 (Warn and bypass), 4 (Block), 5 (Allow)|-|`DlpPolicyRuleMatchInfo`|	`dynamic`|	Details of the data loss prevention (DLP)  rules that matched with this event; in JSON array format|+|`DlpPolicyRuleMatchInfo`|	`dynamic`|	Details of the data loss prevention (DLP) rules that matched with this event; in JSON array format| |`FileRenameInfo`|`string`|	Details of the file (file name and extension) before this event|+|`PhysicalAccessPointInfo`|`object`| Information about the physical access in the event, including the physical access point's unique identifier, name, status, and the tag assigned to the asset| |`PhysicalAccessPointId`|	`string`|	Unique identifier for the physical access point| |`PhysicalAccessPointName`|	`string`|	Name of the physical access point| |`PhysicalAccessStatus`	|`string`|	Status of physical access, whether it succeeded or failed| |`PhysicalAssetTag`|`string`	|Tag assigned to the asset as configured in Microsoft Insider Risk Management global settings|+|`RemovableMediaInfo`|`object`|List of any removable media involved in the behavior, including the serial number of the removable media device, the manufacturer of the removable media device, and the model of the removable device| |`RemovableMediaManufacturer`|`string`|	Manufacturer name of the removable device| |`RemovableMediaModel`|	`string`|	Model name of the removable device|-|`RemovableMediaSerialNumber`|	`string`|Serial number of the removable device|+|`RemovableMediaSerialNumber`|	`string`| Serial number of the removable device| |`TeamsChannelName`|`string`|	Name of the Teams channel| |`TeamsChannelType`|	`string`|	Type of the Teams channel| |`TeamsTeamName`|	`string`	|Name of the Teams team |@@ -67,13 +66,7 @@ Use this reference to construct queries that return information from this table. |`DeviceSourceLocationType`|	`int`|	Indicates the type of location where the endpoint signals originated from; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)| |`DeviceDestinationLocationType`|	`int`|	Indicates the type of location where the endpoint signals connected to; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)| |`IrmPolicyMatchInfo`|	`dynamic`| Details of Insider Risk Management policy matches for the content involved in the event; in JSON array format |	-|`UnallowedUrlDomains`|	`string`|	Websites or service URLs involved in this event that is configured as Unallowed in Insider Risk Management global settings| |`ExternalUrlDomains`|	`string`|	Websites or service URLs involved in this event that is classified as External in Insider Risk Management global settings|-|`UrlDomainInfo`|	`string`|	Details about the websites or service URLs involved in the event|-|`SourceUrlDomain`|	`string`|	Domain where the device and email signals originated|-|`TargetUrlDomain`|	`string`|	Domain where the content was shared with or the user has browsed to|-|`EmailAttachmentCount`|`int`| Number of email attachments	|-|`EmailAttachmentInfo`|	`dynamic`|	Details of email attachments; in JSON array format| |`InternetMessageId`|`string`	|Public-facing identifier for the email or Teams message that is set by the sending email system | |`NetworkMessageId`|	`guid`|	Unique identifier for the email, generated by Microsoft 365 | |`EmailSubject`|	`string`|	Subject of the email|@@ -92,13 +85,12 @@ Use this reference to construct queries that return information from this table. |`RecipientEmailAddress`|	`string`|	Email address of the recipient, or email address of the recipient after distribution list expansion| |`SiteUrl`|	`string` | The URL of the site where the file or folder accessed by the user is located |	 |`SourceRelativeUrl`|	`string`| The URL of the folder that contains the file accessed by the user |	-|`TargetFilePath`|	`string`|	Target file path of endpoint activities| |`PrinterName`|	`string`|	List of printers involved in the behavior|-|`Workload`|`string`|	The Microsoft 365 service where the event occurred| |`IrmActionCategory`|	`enum`|	A unique enumeration value indicating the activity category in Microsoft Purview Insider Risk Management|+|`RiskyAIUsageAccessedResourceInfo`|`object`| Details of the resources accessed or referenced by the application involved in the risky AI usage event|+|`RiskyAIUsageAppCategory`|`string`| Details of the category of the application involved in the risky AI usage event|+|`RiskyAIUsageSensitivityLabelsInfo`|`object`| Information regarding the sensitivity labels of entities involved in the risky AI usage event| |`SequenceCorrelationId`|`string`	|Details of the sequence activity|-|`CloudAppAlertId`|`string`	| Unique identifier for the alert in Microsoft Defender for Cloud Apps |-  ## Related articles