EmailUrlInfo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

Information about URLs on emails

Attribute Value
Category Defender
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Azure Monitor Tables Reference View Documentation
Defender XDR Advanced Hunting Schema View Documentation

Contents

Schema (11 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
NetworkMessageId string Email unique identifier generated by Office 365
ReportId string Unique identifier for the event
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime Date and time (UTC) when the record was generated
Type string The name of the table
Url string Information about URLs on Office 365 emails
UrlDomain string Domain part of the Url
UrlLocation string Indicates which part of the email the URL is located

Solutions (8)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
Microsoft Defender XDR

Content Items Using This Table (38)

Analytic Rules (6)

In solution Threat Intelligence:

Analytic Rule Selection Criteria
TI Map URL Entity to EmailUrlInfo
TI map Domain entity to EmailUrlInfo

In solution Threat Intelligence (NEW):

Analytic Rule Selection Criteria
TI Map URL Entity to EmailUrlInfo
TI map Domain entity to EmailUrlInfo

In solution Visa Threat Intelligence (VTI):

Analytic Rule Selection Criteria
VTI - High Severity Domain Collision Detection

Standalone Content:

Analytic Rule Selection Criteria
Star Blizzard C2 Domains August 2022

Hunting Queries (26)

In solution Microsoft Defender XDR:

Hunting Query Selection Criteria
Message with URL listed on OpenPhish delivered into Inbox
Potential OAuth phishing email delivered into Inbox

GitHub Only:

Hunting Query Selection Criteria
Appspot Phishing Abuse
Appspot Phishing Abuse
Appspot Phishing Abuse
Custom detection-Emails with QR from non-prevalent senders
Custom detection-Emails with QR from non-prevalent senders
Detect DNS obfuscation using @ symbol
Emails containing links to IP addresses
Emails containing links to IP addresses
Hunt for malicious URLs using external IOC source
Hunt for malicious URLs using external IOC source
IcedId email delivery
Malicious Emails with QR code Urls
Malicious Emails with QR code Urls
Message with URL listed on OpenPhish delivered into Inbox
PhishingEmailUrlRedirector
PhishingEmailUrlRedirector (1)
PhishingEmailUrlRedirector (1)
Potential OAuth phishing email delivered into Inbox
Punycode lookalikes
Punycode lookalikes
StrRAT-Email-Delivery
Suspicious Google Doc Links
URLs by location
URLs by location

Workbooks (6)

In solution MaturityModelForEventLogManagementM2131:

Workbook Selection Criteria
MaturityModelForEventLogManagement_M2131

In solution Microsoft Defender XDR:

Workbook Selection Criteria
MicrosoftDefenderForOffice365detectionsandinsights

In solution Microsoft Defender for Office 365:

Workbook Selection Criteria
MicrosoftDefenderForOffice365

In solution ZeroTrust(TIC3.0):

Workbook Selection Criteria
ZeroTrustTIC3

GitHub Only:

Workbook Selection Criteria
MicrosoftDefenderForOffice365
MicrosoftSentinelDeploymentandMigrationTracker

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index