MDE OS Architecture value change

Originally posted by Microsoft May 21, 2021 Microsoft 365 suite 0 Comments

OS Architecture values as they are exposed today across the system use a terminology that refers to Intel processors. In extending the coverage of Microsoft Defender for Endpoints (MDE) to additional processors and platforms, we’re aligning to a neutral terminology and changing OS Architecture values.

Note: This change may impact Advanced hunting saved queries, queries run through API or custom detections that may not return expected results after the change has been rolled out.

Key points

• Timing: We plan to begin rolling this update out to preview customers in late June and expect it to be fully rolled out to Standard release by early July.
• Roll-out: Tenant Level
• Action: review, assess and check the values as a condition per the below OS Architecture values

How this will affect your organization

Advanced hunting saved queries, queries run through API or custom detections may not return expected results after the change has been rolled out.

What you need to do to prepare:

Any saved query, API call or custom detection using the DeviceInfo:OSArchitecture field and checking the values as a condition should be changed to include the new values described below.

Attention: We are changing OS Architecture values from “x32” / “x64” to “32-bit” / “64-bit”. This change will be reflected across the system:

Procedure steps:

• In the device side pane and page
  • No action required
• In advanced hunting
  • DeviceInfo table: OSArchitecture field will change to reflect the new values.
  • Action: if you have any saved queries / AH API calls / custom detections with a condition on this field please update to include the new values
• In machines API
  • A new property OSArchitecture will be added with the new values.
  • Existing OSProcessor property will continue to be sent as is.
  • Recommended Action: if you have any apps checking for OSProcessor values, it is recommended to align to the new property and values.

Message ID: MC257470