How do I see DeviceTvm* in advanced threat hunting - no tables seem to exist. I can see Sentinel tables though

Hello Shaw, Gary,

Thank you for posting your query on Microsoft Q&A platform.

1. These tables are populated only if Microsoft Defender for Endpoint (MDE) is deployed and integrated with Microsoft Defender Vulnerability Management (MDVM). If your organization hasn’t deployed or enabled this service, the tables will not appear or return results Reference: https://learn.microsoft.com/en-us/defender-xdr/deploy-supported-services
2. Access to these tables typically requires Microsoft 365 E5 or Defender for Endpoint Plan 2 licenses. Without the correct licensing, the data won’t be ingested into the Defender XDR portal

Reference: https://learn.microsoft.com/en-us/defender-xdr/prerequisites#licensing-requirements

1. Even if the service is deployed, role-based access control (RBAC) settings might restrict visibility. Ensure your account has the necessary roles like Security Administrator or Security Operator with the "Manage Security Settings" permission

Reference: https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules

Once the prerequisites are met, you can use Advanced Hunting in the Defender portal to query tables like:

• DeviceTvmSoftwareInventory
• DeviceTvmSoftwareVulnerabilities
• DeviceTvmSecureConfigurationAssessment
• DeviceTvmHardwareFirmware

Reference: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-schema-tables

Thanks,

Suchitra.