Important
Some information relates to prereleased product which may be substantially modified before it’s commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
The Event Streaming API is constantly being expanded to support more event types. Learn which Hunting tables are generally available, currently in public preview, or not yet supported. New – Email event types/tables are now GA
Hunting tables support status in Event Streaming API
The following table only includes the list of the tables supported in the streaming API, and is not inclusive of all AH schema. For a full list of the API see, Learn the schema tables.
| Table name | Status |
|---|---|
| AlertEvidence | GA |
| AlertInfo | GA |
| DeviceEvents | GA |
| DeviceFileCertificateInfo | GA |
| DeviceFileEvents | GA |
| DeviceImageLoadEvents | GA |
| DeviceInfo | GA |
| DeviceLogonEvents | GA |
| DeviceNetworkEvents | GA |
| DeviceNetworkInfo | GA |
| DeviceProcessEvents | GA |
| DeviceRegistryEvents | GA |
| EmailAttachmentInfo | GA |
| EmailEvents | GA |
| EmailPostDeliveryEvents | GA |
| EmailUrlInfo | GA |