Microsoft Defender XDR
Hunting and detectionAdvanced Hunting Schema Tables
In brief
The schema page no longer labels AgentsInfo as Preview and no longer lists AIAgentsInfo.
What Defender admins need to know
No administrator action is required; update references if you use this schema list.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| --- | --- |
| AADSignInEventsBeta | Microsoft Entra interactive and non-interactive sign-ins |
| AADSpnSignInEventsBeta | Microsoft Entra service principal and managed identity sign-ins |
| AgentsInfo (Preview) | Information about AI agents and their properties from various platforms |
| AIAgentsInfo (Preview) | Information about AI agents created with Microsoft Copilot Studio, including agent configuration and ownership details |
| AlertEvidence | Files, IP addresses, URLs, users, or devices associated with alerts |
| AlertInfo | Alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity, including severity information and threat categorization |
| BehaviorEntities (Preview) | Entities (file, process, device, user, and others) that are involved in a behavior in Microsoft Defender for Cloud Apps (not available for GCC) and User and Entity Behavior Analytics (UEBA) |
@@ -83,8 +83,7 @@ The following reference lists all the tables in the schema. Each table name link | --- | --- |
| **[AADSignInEventsBeta](advanced-hunting-aadsignineventsbeta-table)** | Microsoft Entra interactive and non-interactive sign-ins |
| **[AADSpnSignInEventsBeta](advanced-hunting-aadspnsignineventsbeta-table)** | Microsoft Entra service principal and managed identity sign-ins |
-| **[AgentsInfo](advanced-hunting-agentsinfo-table)** (Preview) | Information about AI agents and their properties from various platforms |
-| **[AIAgentsInfo](advanced-hunting-aiagentsinfo-table)** (Preview) | Information about AI agents created with Microsoft Copilot Studio, including agent configuration and ownership details |
+| **[AgentsInfo](advanced-hunting-agentsinfo-table)** | Information about AI agents and their properties from various platforms |
| **[AlertEvidence](advanced-hunting-alertevidence-table)** | Files, IP addresses, URLs, users, or devices associated with alerts |
| **[AlertInfo](advanced-hunting-alertinfo-table)** | Alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity, including severity information and threat categorization |
| **[BehaviorEntities](advanced-hunting-behaviorentities-table)** (Preview) | Entities (file, process, device, user, and others) that are involved in a behavior in Microsoft Defender for Cloud Apps (not available for GCC) and User and Entity Behavior Analytics (UEBA) |