Microsoft Defender XDR
Hunting and detectionAdvanced Hunting Schema Tables
In brief
The documentation now lists the CloudKeyVaultEvents table, marked Preview, for operations performed against Azure Key Vault resources.
What Defender admins need to know
Administrators can review this table when investigating Azure Key Vault activity. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| CloudAppEvents | Events involving accounts and objects in Office 365 and other cloud apps and services | | CloudAuditEvents | Cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud | | CloudDnsEvents | DNS activity events from cloud infrastructure environments | | CloudKeyVaultEvents (Preview) | Operations performed against Azure Key Vault resources | | CloudPolicyEnforcementEvents (Preview) | Policy enforcement evaluation decisions and metadata of security gating events for various cloud platforms protected by the organization's Microsoft Defender for Cloud | | CloudProcessEvents (Preview) | Cloud process events for various cloud platforms protected by the organization's Microsoft Defender for Containers | | CloudStorageAggregatedEvents (Preview) | Cloud storage activity and related events |
@@ -22,7 +22,7 @@ ms.custom: - cx-ah - msecd-doc-authoring-1018 ms.topic: reference-ms.date: 2026-07-27T00:00:00.0000000Z+ms.date: 2026-10-28T00:00:00.0000000Z ai-usage: ai-assisted locale: en-us document_id: 5ea94a55-ae13-98b1-1ded-bee037019f7a@@ -41,12 +41,12 @@ item_type: Content source_path: defender-xdr/advanced-hunting-schema-tables.md cmProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1577a46d-8446-40bd-bfae-0578362f4d94-- https://authoring-docs-microsoft.poolparty.biz/devrel/1e69816a-aaaa-474e-a36f-3ec7790fadc3 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca+- https://authoring-docs-microsoft.poolparty.biz/devrel/1e69816a-aaaa-474e-a36f-3ec7790fadc3 spProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/cdf3f22d-5420-4d59-a2bf-66d6b3d9c828-- https://authoring-docs-microsoft.poolparty.biz/devrel/ae012320-d2b3-47d8-abdc-898a64d069a9 - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98+- https://authoring-docs-microsoft.poolparty.biz/devrel/ae012320-d2b3-47d8-abdc-898a64d069a9 platformId: dc25ecc3-7937-c18f-2325-c792835e763b --- @@ -93,6 +93,7 @@ The following reference lists all the tables in the schema. Each table name link | **[CloudAppEvents](advanced-hunting-cloudappevents-table)** | Events involving accounts and objects in Office 365 and other cloud apps and services |
| **[CloudAuditEvents](advanced-hunting-cloudauditevents-table)** | Cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
| **[CloudDnsEvents](advanced-hunting-clouddnsevents-table)** | DNS activity events from cloud infrastructure environments |
+| **[CloudKeyVaultEvents](advanced-hunting-cloudkeyvaultevents-table)** (Preview) | Operations performed against Azure Key Vault resources |
| **[CloudPolicyEnforcementEvents](advanced-hunting-cloudpolicyenforcementevents-table)** (Preview) | Policy enforcement evaluation decisions and metadata of security gating events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
| **[CloudProcessEvents](advanced-hunting-cloudprocessevents-table)** (Preview) | Cloud process events for various cloud platforms protected by the organization's Microsoft Defender for Containers |
| **[CloudStorageAggregatedEvents](advanced-hunting-cloudstorageaggregatedevents-table)** (Preview) | Cloud storage activity and related events |