Notifications
Clear all
Microsoft Defender for Endpoint Reviews
1
Posts
1
Users
0
Reactions
3
Views
Topic starter
15/07/2026 3:43 am
Just got burned by their latest "security update." The Advanced Hunting API schema changed without warning. Our entire incident triage automation is now broken.
Key changes that caused the 400s:
* `DeviceId` field renamed to `DeviceName` in several tables.
* `Timestamp` format now enforces ISO 8601 with stricter timezone handling.
* Several deprecated fields (`OldThreatName`) silently removed instead of returning null.
No deprecation notice in the changelog. No grace period. Classic move: improve their backend, break everyone else's integrations.
Anyone else scrambling to patch scripts? Specifically seeing issues with `DeviceFileEvents` and `DeviceNetworkEvents`.
If they offer a 'free demo', you're the product.