WDAC Advanced Hunting Retired ActionTypes and Fields
Microsoft will be making changes to the PolicyNameBuffer and PolicyIdBuffer fields in MDE Advanced Hunting WDAC events by renaming them to PolicyName and PolicyID respectively. Some of the WDAC action types, including AppControlCodeIntegrityImageAudited (3035), AppControlCodeIntegrityPolicyAudited (3078), AppControlCodeIntegrityPolicyBlocked (3079), AppControlCodeIntegrityPolicyAudited (3080), and AppControlCodeIntegrityPolicyBlocked (3081) will be retired from Advanced Hunting in mid to late January, 2024. Customers using these action types should update their queries to reflect the field name changes in order to avoid breaking their existing custom detections. This update is intended to continue improving the user experience and richness of WDAC event data in Advanced Hunting.
The post WDAC Advanced Hunting Retired ActionTypes and Fields originally appeared on M365 Admin.
Published on:
Learn more
Related posts
Data Loss Prevention – Out-of-box Advanced Hunting queries for Data Loss Prevention incidents in Microsoft 365 Defender
This post provides information about how to use out-of-box advanced hunting queries for Data Loss Prevention incidents in Microsoft 365 Defend...
Advanced Threat Hunting with Microsoft 365 Defender
In this podcast episode, Michael and Michael dive into the world of advanced threat hunting using Microsoft 365 Defender. Joining the conversa...
Microsoft Purview compliance portal: Data Loss Prevention- Out-of-box Advanced Hunting queries for Data Loss Prevention incidents in Microsoft 365 Defender
Microsoft Purview compliance portal has introduced Out-of-box Advanced Hunting queries for Data Loss Prevention incidents in Microsoft 365 Def...
Microsoft Defender for Office 365: 100 Admin Submission at once
Microsoft Defender for Office 365 admins can now submit up to 100 emails for analysis at once from advanced hunting, threat explorer, and user...
Improving the pipeline of Identity-related tables in Microsoft 365 Defender Advanced hunting
Microsoft 365 Defender Advanced hunting is making an improvement to the pipeline of Identity-related tables to reduce delay times in identity-...
ChatGPT Advanced Data Analysis: Explained
The blog post explores the advanced data analysis capabilities of ChatGPT, which has gained popularity for its text-generation abilities. In a...
Power BI Data Model For Advanced Scenario Analysis Using DAX
Discover the full potential of Power BI as an analytical tool with this tutorial focusing on developing a data model tailored for advanced sce...
What is Power Query: A Step-By-Step Guide for Data Analysis
In the realm of data analysis, performing repetitive tasks in Excel or Power BI can be exhausting. But fear not, because Power Query is here t...
Threat Protection report page retirement
Microsoft has announced the retirement of the Threat Protection report page that is accessed through Reports > Endpoints > Threat Protection. ...