{"id":4367,"date":"2023-12-12T10:01:50","date_gmt":"2023-12-12T01:01:50","guid":{"rendered":"https:\/\/m365jp.xyz\/?p=4367"},"modified":"2023-12-12T10:14:21","modified_gmt":"2023-12-12T01:14:21","slug":"mc697431-wdac-advanced-hunting-retired-actiontypes-and-fields","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2023-12-12-mc697431-wdac-advanced-hunting-retired-actiontypes-and-fields","title":{"rendered":"MC697431 | WDAC Advanced Hunting Retired ActionTypes and Fields"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC697431 | WDAC Advanced Hunting Retired ActionTypes and Fields<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n
Classification<\/th>\nplanForChange<\/td>\n<\/tr>\n
Last Updated<\/th>\n12\/12\/2023 00:14:37<\/td>\n<\/tr>\n
Start Time<\/th>\n12\/12\/2023 00:14:11<\/td>\n<\/tr>\n
End Time<\/th>\n02\/15\/2024 08:00:00<\/td>\n<\/tr>\n
Message Content<\/th>\n\n

Microsoft will be renaming the PolicyNameBuffer<\/i> and PolicyIdBuffer<\/i> fields in MDE Advanced Hunting WDAC<\/i> <\/b>events. These fields will be renamed to PolicyName<\/i> and PolicyID,<\/i> respectively. We will continue to improve the experience and richness of WDAC event data in Advanced Hunting. <\/p>\n

Additionally, we will be retiring the following WDAC action types from Advanced Hunting: <\/p>\n

    \n
  • AppControlCodeIntegrityImageAudited (3035)<\/li>\n
  • AppControlCodeIntegrityPolicyAudited (3078)<\/li>\n
  • AppControlCodeIntegrityPolicyBlocked (3079)<\/li>\n
  • AppControlCodeIntegrityPolicyAudited (3080)<\/li>\n
  • AppControlCodeIntegrityPolicyBlocked (3081)<\/li>\n<\/ul>\n

    [When this will happen:]<\/p>\n

    We will begin rolling out this change in mid-January 2024 and expect to complete by late January 2024.<\/p>\n

    [How this will affect your organization:]<\/p>\n

    For customers currently using the WDAC “AppControl” action types, here is a list of the fields that will be retired, alongside their alternatives in Advanced Hunting: <\/p>\n\n\n <\/p>\n\n <\/p>\n <\/p>\n\n
    Old Field<\/th>\n

    <\/p>\n

    		New Field<\/th>\n

    <\/tr>\n<\/tbody>\n

    PolicyNameBuffer<\/span><\/th>\n

    <\/p>\n

    		PolicyName<\/span><\/th>\n

    <\/tr>\n

    <\/p>\n

    PolicyIdBuffer<\/span><\/th>\n

    <\/p>\n

    		PolicyID<\/span><\/th>\n

    <\/tr>\n

    <\/tbody>\n<\/table>\n

    [What you can do to prepare:] <\/p>\n

    <\/p>\n

    Your organization might be using PolicyNameBuffer<\/i> <\/b>or PolicyIdBuffer<\/i> <\/b>in your Advanced Hunting queries and custom detections which will be retired soon. Please update your queries with the new fields to continue to leverage this valuable data and avoid breaking your current custom detections. <\/p>\n

    An example of your old query: <\/p>\n

    DeviceEvents<\/code><\/p>\n

    | where ActionType startswith 'AppControl'
    <\/code><\/p>\n

    | extend PolicyName = parsejson(AdditionalFields).PolicyNameBuffer<\/code><\/p>\n

    | extend PolicyId = parsejson(AdditionalFields).PolicyIdBuffer<\/code><\/p>\n

    | project ActionType,PolicyId,PolicyName<\/code><\/p>\n

    <\/p>\n

    Your new query:<\/p>\n

    <\/p>\n

    DeviceEvents<\/code><\/p>\n

    | where ActionType startswith 'AppControl'<\/code><\/p>\n

    | extend PolicyName = parsejson(AdditionalFields).PolicyName<\/code><\/p>\n

    | extend PolicyId = parsejson(AdditionalFields).PolicyID<\/code><\/p>\n

    | project ActionType,PolicyId,PolicyName<\/code><\/p>\n<\/td>\n<\/tr>\n

    Machine Translation<\/th>\n\n

    Microsoft \u306f\u3001MDE Advanced Hunting WDAC<\/i> <\/b>\u30a4\u30d9\u30f3\u30c8\u306e PolicyNameBuffer \u30d5\u30a3\u30fc\u30eb\u30c9\u3068 PolicyIdBuffer<\/i> <\/i> \u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u540d\u524d\u3092\u5909\u66f4\u3057\u307e\u3059\u3002\u3053\u308c\u3089\u306e\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u540d\u524d\u306f\u3001\u305d\u308c\u305e\u308c PolicyName<\/i> \u3068 PolicyID<\/i> \u306b\u5909\u66f4\u3055\u308c\u307e\u3059\u3002Advanced Hunting \u3067\u306e WDAC \u30a4\u30d9\u30f3\u30c8 \u30c7\u30fc\u30bf\u306e\u30a8\u30af\u30b9\u30da\u30ea\u30a8\u30f3\u30b9\u3068\u8c4a\u5bcc\u3055\u3092\u5f15\u304d\u7d9a\u304d\u6539\u5584\u3057\u307e\u3059\u3002 <\/p>\n

    \u3055\u3089\u306b\u3001Advanced Hunting \u304b\u3089\u6b21\u306e WDAC \u30a2\u30af\u30b7\u30e7\u30f3\u306e\u7a2e\u985e\u3092\u5ec3\u6b62\u3057\u307e\u3059\u3002 <\/p>\n

      \n
    • AppControlCodeIntegrityImageAudited (3035)<\/li>\n
    • AppControlCodeIntegrityPolicyAudited (3078)<\/li>\n
    • AppControlCodeIntegrityPolicyBlocked (3079)<\/li>\n
    • AppControlCodeIntegrityPolicyAudited (3080)<\/li>\n
    • AppControlCodeIntegrityPolicyBlocked (3081)<\/li>\n<\/ul>\n

      [\u3053\u308c\u304c\u3044\u3064\u8d77\u3053\u308b\u304b:]<\/p>\n

      \u3053\u306e\u5909\u66f4\u306f 2024 \u5e74 1 \u6708\u4e2d\u65ec\u306b\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u3092\u958b\u59cb\u3057\u30012024 \u5e74 1 \u6708\u4e0b\u65ec\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n

      [\u3053\u308c\u304c\u7d44\u7e54\u306b\u53ca\u307c\u3059\u5f71\u97ff:]<\/p>\n

      \u73fe\u5728 WDAC \u306e “AppControl” \u30a2\u30af\u30b7\u30e7\u30f3\u306e\u7a2e\u985e\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u304a\u5ba2\u69d8\u306e\u5834\u5408\u3001\u5ec3\u6b62\u3055\u308c\u308b\u30d5\u30a3\u30fc\u30eb\u30c9\u306e\u4e00\u89a7\u3068\u3001Advanced Hunting \u306e\u4ee3\u66ff\u624b\u6bb5\u3092\u6b21\u306b\u793a\u3057\u307e\u3059\u3002 <\/p>\n\n\n <\/p>\n\n <\/p>\n <\/p>\n
      \u53e4\u3044<\/th>\n

      \u30d5\u30a3\u30fc\u30eb\u30c9 <\/p>\n

      		\u65b0\u3057\u3044\u30d5\u30a3\u30fc\u30eb\u30c9<\/th>\n<\/tr>\n<\/tbody>\n
      PolicyNameBuffer<\/span><\/th>\n

      <\/p>\n

      		\u30dd\u30ea\u30b7\u30fc\u540d<\/span><\/th>\n

      <\/tr>\n

      <\/p>\n

      PolicyIdBuffer<\/span><\/th>\n

      <\/p>\n

      		\u30dd\u30ea\u30b7\u30fc ID<\/span><\/th>\n

      <\/tr>\n

      <\/tbody>\n<\/table>\n

      \u3010\u6e96\u5099\u306e\u305f\u3081\u306b\u3067\u304d\u308b\u3053\u3068\u3011<\/p>\n

      <\/p>\n

      \u7d44\u7e54\u3067\u306f\u3001\u9ad8\u5ea6\u306a\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0 \u30af\u30a8\u30ea\u3068\u30ab\u30b9\u30bf\u30e0\u691c\u51fa\u3067 PolicyNameBuffer<\/i> \u307e\u305f\u306f PolicyIdBuffer<\/i> <\/b><\/b>\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b \u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u304c\u3001\u3053\u308c\u3089\u306f\u307e\u3082\u306a\u304f\u5ec3\u6b62\u3055\u308c\u307e\u3059\u3002\u3053\u306e\u8cb4\u91cd\u306a\u30c7\u30fc\u30bf\u3092\u5f15\u304d\u7d9a\u304d\u6d3b\u7528\u3057\u3001\u73fe\u5728\u306e\u30ab\u30b9\u30bf\u30e0\u691c\u51fa\u304c\u58ca\u308c\u306a\u3044\u3088\u3046\u306b\u3001\u65b0\u3057\u3044\u30d5\u30a3\u30fc\u30eb\u30c9\u3067\u30af\u30a8\u30ea\u3092\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044\u3002 <\/p>\n

      \u53e4\u3044\u30af\u30a8\u30ea\u306e\u4f8b:<\/p>\n

      DeviceEvents<\/code><\/p>\n

      | where ActionType startswith 'AppControl'
      <\/code><\/p>\n

      | extend PolicyName = parsejson(AdditionalFields).PolicyNameBuffer<\/code><\/p>\n

      | extend PolicyId = parsejson(AdditionalFields).PolicyIdBuffer<\/code><\/p>\n

      | project ActionType,PolicyId,PolicyName<\/code><\/p>\n

      <\/p>\n

      \u65b0\u3057\u3044\u30af\u30a8\u30ea\u3067\u306f\u3001\u6b21\u306e\u3053\u3068\u3092\u884c\u3044\u307e\u3059\u3002<\/p>\n

      <\/p>\n

      DeviceEvents<\/code><\/p>\n

      | where ActionType startswith 'AppControl'<\/code><\/p>\n

      | extend PolicyName = parsejson(AdditionalFields).PolicyName<\/code><\/p>\n

      | extend PolicyId = parsejson(AdditionalFields).PolicyID<\/code><\/p>\n

      | project ActionType,PolicyId,PolicyName<\/code><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

      MC697431 | WDAC Advanced Hunting Retired ActionTypes and Fields Classification planForChange Last Updated 12\/1 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4367","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/4367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=4367"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/4367\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=4367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=4367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=4367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}