From 8118f3387ce2165d5f1c283bd08d568642b77321 Mon Sep 17 00:00:00 2001 From: 0xv1n <11021725+0xv1n@users.noreply.github.com> Date: Thu, 12 Sep 2024 13:05:19 -0400 Subject: [PATCH 1/2] Update advanced-hunting-aadsignineventsbeta-table.md --- defender-xdr/advanced-hunting-aadsignineventsbeta-table.md | 1 + 1 file changed, 1 insertion(+) diff --git a/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md b/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md index 3c4b1af60f..f1bcef6d50 100644 --- a/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md +++ b/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md @@ -80,6 +80,7 @@ Use this reference to construct queries that return information from the table. |`NetworkLocationDetails`|`string`|Network location details of the authentication processor of the sign-in event| |`RequestId`|`string`|Unique identifier of the request| |`ReportId`|`string`|Unique identifier for the event| +|`EndpointCall`|`string`|Indicates the endpoint called during a login event. Possible values: "Login:reprocess", "Kmsi:kmsi"| ## Related articles From b2a5ea4c2737fc4fa2b25617062580025ea996e2 Mon Sep 17 00:00:00 2001 From: 0xv1n <11021725+0xv1n@users.noreply.github.com> Date: Tue, 10 Dec 2024 19:10:14 -0500 Subject: [PATCH 2/2] Update advanced-hunting-aadsignineventsbeta-table.md --- defender-xdr/advanced-hunting-aadsignineventsbeta-table.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md b/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md index 595054481f..2c86ebd2fc 100644 --- a/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md +++ b/defender-xdr/advanced-hunting-aadsignineventsbeta-table.md @@ -83,7 +83,7 @@ Use this reference to construct queries that return information from the table. |`NetworkLocationDetails`|`string`|Network location details of the authentication processor of the sign-in event| |`RequestId`|`string`|Unique identifier of the request| |`ReportId`|`string`|Unique identifier for the event| -|`EndpointCall`|`string`|Indicates the endpoint called during a login event. Possible values: "Login:reprocess", "Kmsi:kmsi"| +|`EndpointCall`|`string`|Information about the Microsoft Entra ID endpoint that the request was sent to and the type of request sent during sign in.| ## Related articles