We are not getting the required data from AlertEvidence table ( Defender for Endpoint) using Advanced Hunting connector.

Question

The logic app is working perfectly fine we are using below query.

DeviceInfo
| where DeviceId contains "dd71b3fb23feca64a073cdb10186b1fde1090770"
| where OSPlatform != ""
| summarize max(Timestamp) by DeviceId,DeviceName,OSPlatform

----------------------------------------------------

But when we are using this query:

AlertEvidence
| where Timestamp > ago(30m)
| where DeviceName == "vm01"
| summarize count= count() by DeviceName

We are getting the error-
{
"error": {
"code": "BadRequest",
"message": "'where' operator: Failed to resolve table or column expression named 'AlertEvidence'. Fix semantic errors in your query.",
"target": "|1d161bd4-45ba8932dafe0f69."
}
}

Answer 1

Apparently, I did find the answer to this. The answer secondarily is MS' Poor Documentation. The actual answer.

The tables AlertEvidence AND AlertInfo are new tables that broke down from DeviceAlertEvents which was their old API I guess. But apparently, the MDEATP connector still supports the old one. So to correct this, your new query would be

DeviceAlertEvents | where ... etc