Microsoft Defender XDR
Hunting and detectionAdvanced Hunting Cloudstorageaggregatedevents Table
In brief
The documentation now states that the table is populated only when Defender for Storage V2 is enabled at the subscription level. Storage-account-level enablement and the legacy plan are not supported.
What Defender admins need to know
Enable Defender for Storage V2 at the subscription level to populate this table; account-level or legacy-plan deployments will not provide data.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
This advanced hunting table is populated by records from Microsoft Defender for Cloud. If your organization doesn't have Microsoft Defender for Cloud, queries that use the table aren’t going to work or return any results. For more information about prerequisites in integrating Defender for Cloud with Defender, read Microsoft Defender XDR integration.
The CloudStorageAggregatedEvents table is populated only for subscriptions with Defender for Storage V2 enabled at the subscription level. Enabling Defender for Storage only at the individual storage-account level does not qualify. The legacy Defender for Storage plan is not supported.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
| Column name | Data type | Description |
@@ -11,7 +11,7 @@ manager: orspodek description: Learn about the CloudStorageAggregatedEvents table in the advanced hunting schema, which contains information about storage activity and related events. ms.service: defender-xdr ms.subservice: adv-hunting-ms.author: pauloliveria+ms.author: eitanbremler author: poliveria ms.localizationpriority: medium ms.collection:@@ -39,11 +39,11 @@ item_type: Content source_path: defender-xdr/advanced-hunting-cloudstorageaggregatedevents-table.md cmProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/1577a46d-8446-40bd-bfae-0578362f4d94-- https://authoring-docs-microsoft.poolparty.biz/devrel/fcc3cd4a-59ea-47a2-9cc1-784142a5a25d+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/c671beaa-a830-4c9f-aceb-97379ee031ca - https://authoring-docs-microsoft.poolparty.biz/devrel/8e3fdb08-a059-4277-98f6-c0e21e940707 spProducts: - https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/cdf3f22d-5420-4d59-a2bf-66d6b3d9c828-- https://authoring-docs-microsoft.poolparty.biz/devrel/d7a55faf-a992-4e27-aa3a-eadc9830e778+- https://microsoft-devrel.poolparty.biz/DevRelOfferingOntology/8921374c-4dbe-4ed0-b011-a39e18bfbd98 - https://authoring-docs-microsoft.poolparty.biz/devrel/88291526-9c74-4f87-878c-de0a82134421 platformId: 3f20f50c-027e-5cc6-9322-54256d616e9f ---@@ -58,6 +58,8 @@ Some information relates to prereleased product, which may be substantially modi
This advanced hunting table is populated by records from [Microsoft Defender for Cloud](/en-us/azure/defender-for-cloud/concept-integration-365#advanced-hunting-in-xdr). If your organization doesn't have Microsoft Defender for Cloud, queries that use the table aren’t going to work or return any results. For more information about prerequisites in integrating Defender for Cloud with Defender, read [Microsoft Defender XDR integration](/en-us/azure/defender-for-cloud/concept-integration-365).
+The `CloudStorageAggregatedEvents` table is populated only for subscriptions with Defender for Storage V2 enabled at the subscription level. Enabling Defender for Storage only at the individual storage-account level does not qualify. The legacy Defender for Storage plan is not supported.
+
For information on other tables in the advanced hunting schema, see the [advanced hunting reference](advanced-hunting-schema-tables).
| Column name | Data type | Description |