MessageUrlInfo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

URLs sent through Microsoft Teams messages in your organization

Attribute Value
Category Security, XDR
Basic Logs Eligible ✓ Yes (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Lake-Only Ingestion ✓ Yes
Azure Monitor Tables Reference View Documentation
Defender XDR Advanced Hunting Schema View Documentation

Contents

Schema (11 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
ReportId string Unique identifier for the event
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TeamsMessageId string Unique identifier for the message, as generated by Microsoft 365
TenantId string The Log Analytics workspace ID
ThreatTypes string Verdict from the filtering stack on whether the message contains malware, phishing, or other threats
TimeGenerated datetime Date and time (UTC) when the record was generated.
Type string The name of the table
Url string URL from message
UrlDomain string Domain name or host name of the URL

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Content Items Using This Table (22)

Hunting Queries (21)

In solution Microsoft Defender XDR:

Hunting Query Selection Criteria
External Microsoft Teams Sender Domain Risk
Hunt for malicious messages using External Threat Intelligence
Low-Reputation URL Domains Shared in Microsoft Teams
Rare Domains in External Teams Messages
Suspicious Microsoft Teams Sender Domains Without a Threat Verdict
Teams Message with URL listed on OpenPhish
Teams messages with suspicious URL domains
Teams users clicking on suspicious URL domains
URL Domains Triggering Microsoft Teams Safety Tips

GitHub Only:

Hunting Query Selection Criteria
External Microsoft Teams Sender Domain Risk
Hunt for malicious messages using External Threat Intelligence
Low-Reputation URL Domains Shared in Microsoft Teams
Punycode lookalikes
Punycode lookalikes
Rare Domains in External Teams Messages
Suspicious Microsoft Teams Sender Domains Without a Threat Verdict
Teams Message with URL listed on OpenPhish
Teams Threat Intelligence Indicator Hit for Domain or URL
Teams messages with suspicious URL domains
Teams users clicking on suspicious URL domains
URL Domains Triggering Microsoft Teams Safety Tips

Workbooks (1)

In solution Microsoft Defender XDR:

Workbook Selection Criteria
MicrosoftDefenderForOffice365detectionsandinsights

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index