MicrosoftDefenderForOffice365detectionsandinsights

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

Attribute	Value
Type	Workbook
Solution	Microsoft Defender XDR
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
`AlertEvidence`	`ActionType in "AdminSubmission,AdminSubmissionSubmitted,AttackSimUserSubmission,CallParticipantDetail,CallReported,ClickAllowed,ClickBlocked,ClickBlockedByTenantPolicy,Malware ZAP,Phish ZAP,Spam ZAP,TeamsImpersonationDetected,UserSubmission"` `ActionType == "Automated Remediation"` `ActionType contains "Submission"` `ActionType contains "UserSubmission"` `ActionType contains "ZAP"` `ActionType has "ClickAllowed"` `ActionType has "ClickBlocked"` `ActionType has "Malware ZAP"` `ActionType has "Phish ZAP"` `ActionType has "Spam ZAP"` `ActionType has "ZAP"` `ActionType has_any "ClickAllowed"` `ActionType has_any "ClickBlocked"` `ActionType has_any "UrlErrorPage"` `ActionType has_any "UrlScanInProgress"`	✓	✗	✓
`CloudAppEvents`	`ActionType in "AdminSubmission,AdminSubmissionSubmitted,AttackSimUserSubmission,CallParticipantDetail,Malware ZAP,Phish ZAP,Spam ZAP,SubmissionNotification,UserSubmission"` `ActionType contains "AdminSubmission"` `ActionType contains "AdminSubmissionTriage"` `ActionType contains "Submission"` `ActionType contains "UserSubmission"` `ActionType contains "UserSubmissionTriage"` `ActionType startswith "AdminSubmission"` `ActionType startswith "UserSubmission"`	✓	✗	✓
`EmailEvents`	`OrgLevelAction in "Allow,Block"` `OrgLevelPolicy != "Phishing simulation"` `OrgLevelPolicy != "SecOps Mailbox"` `OrgLevelPolicy !in "Phishing simulation,SecOps Mailbox"` `UserLevelAction in "Allow,Block"`	✓	✗	✓
`EmailPostDeliveryEvents`		✓	✗	✓
`EmailUrlInfo`		✓	✗	✓
`FileMaliciousContentInfo`		✓	✗	✓
`MessageEvents`		✓	✗	✓
`MessagePostDeliveryEvents`		✓	✗	✓
`MessageUrlInfo`		✓	✗	✓
`SecurityAlert`		✓	✗	✓
`SecurityIncident`	`Classification == "TruePositive"`	✓	✗	✓
`UrlClickEvents`		✓	✗	✓

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Workbooks · Back to Microsoft Defender XDR