SecurityInsight settings · Settings > Collection scope & limits

Schema discovery hunting tables

Key	SI_SchemaTables
Where	Settings > Collection scope & limits
Type	List
Default	A shipped list of 17 high-signal tables (device, identity, alert, email, cloud app, exposure graph).
Edition	Community

What it does

List of Defender advanced-hunting tables whose columns schema discovery checks for new fields.

When set

Replaces the shipped list entirely. Fewer tables means a faster run but new fields elsewhere go unnoticed; tables you cannot query cause errors for that table.

When blank or default

Left blank, the default applies: A shipped list of 17 high-signal tables (device, identity, alert, email, cloud app, exposure graph).

Risk and how to reverse it

Changes what is collected from the next run: narrowing it means some assets or data are not collected, so they look absent in profiles, CIs and reports (absence is never read as fixed). Reversible: change it back; the next run collects again.

Requires

Nothing else.