EmailEvents

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Microsoft 365 email events, including email delivery and blocking events

Attribute	Value
Category	Defender
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation
Defender XDR Advanced Hunting Schema	View Documentation

Schema
Solutions
Connectors
Content Items

Schema (55 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
AdditionalFields	dynamic	Additional information about the entity or event.
AttachmentCount	int	Number of attachments in the email.
AuthenticationDetails	string	List of pass or fail verdicts by email authentication protocols like DMARC, DKIM, SPF or a combination of multiple authentication types (CompAuth).
BulkComplaintLevel	int	Threshold assigned to email from bulk mailers, a high bulk complaint level (BCL) means the email is more likely to generate complaints, and thus more likely to be spam.
Cc	dynamic	Indicates the addresses which are listed in Cc fields of an email
ConfidenceLevel	string	List of confidence levels of any spam or phishing verdicts. For spam, this column shows the spam confidence level (SCL), indicating if the email was skipped (-1), found to be not spam (0,1), found to be spam with moderate confidence (5,6), or found to be spam with high confidence (9). For phishing, this column displays whether the confidence level is "High" or "Low".
Connectors	string	Custom instructions that define organizational mail flow and how the email was routed.
Context	string	Configuration context data of the machine
DeliveryAction	string	Action of the delivered email.
DeliveryLocation	string	Location of the delivered email: Inbox/Folder, On-premises/External, Junk, Quarantine, Failed, Dropped, Deleted items.
DetectionMethods	string	Delivery action of the email: Delivered, Junked, Blocked, or Replaced.
DistributionList	string	Name of distribution list that the recipient was a member of and to which the email was sent, if applicable; shows top-level distribution list if nested lists are involved
EmailAction	string	Final action taken on the email based on filter verdict, policies, and user actions: Move message to junk mail folder, Add X-header, Modify subject, Redirect message, Delete message, send to quarantine, No action taken, Bcc message.
EmailActionPolicy	string	Action policy that took effect: Antispam high-confidence, Antispam, Antispam bulk mail, Antispam phishing, Anti-phishing domain impersonation, Anti-phishing user impersonation, Anti-phishing spoof, Anti-phishing graph impersonation, Antimalware Safe Attachments, Enterprise Transport Rules (ETR).
EmailActionPolicyGuid	string	Unique identifier of the policy that took effect.
EmailClusterId	long	Identifier of the email cluster. Emails are clustered (grouped) based on heuristic analysis of their contents.
EmailDirection	string	Email direction: Inbound, Outbound, Intra-org.
EmailLanguage	string	Detected language of the email content.
EmailSize	int	Size of the email message.
ExchangeTransportRule	string	Mail flow rules (also known as transport rules) are similar to Inbox rules that are available in Outlook and Outlook on the web. The main difference is mail flow rules take action on messages while they're in transit.
ForwardingInformation	string	A JSON array of forwarding details including the forwarding user and the forwarding type
InternetMessageId	string	Public-facing identifier for the email that is set by the sending email system.
IsFirstContact	bool	Is this the first contact between sender and reciever.
LastEventExecutionTime	datetime	Date and time (UTC) when the record was updated post merge.
LatestDeliveryAction	string	Last known action attempted on an email by the service or by an admin through manual remediation.
LatestDeliveryLocation	string	Last known location of the email.
NetworkMessageId	string	Unique identifier for the email, generated by Office 365.
OrgLevelAction	string	Action taken on the email in response to matches to a policy defined at the organizational level.
OrgLevelPolicy	string	Organizational policy that triggered the action taken on the email.
RecipientDomain	string	Domain of the recipient of the email.
RecipientEmailAddress	string	Recipient email address or email address of the recipient after distribution list expansion.
RecipientObjectId	string	Email recipient Azure AD identifier.
ReportId	string	Unique identifier for the event.
SenderDisplayName	string	Sender email address in the from header, which is visible to email recipients on their email clients.
SenderFromAddress	string	Sender domain in the from header, which is visible to email recipients on their email clients.
SenderFromDomain	string	Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats.
SenderIPv4	string	IPv4 address of the last detected mail server that relayed the message.
SenderIPv6	string	IPv6 address of the last detected mail server that relayed the message.
SenderMailFromAddress	string	Sender email address in the MAIL from header, also known as the envelope sender or the Return-Path address.
SenderMailFromDomain	string	Sender domain in the MAIL from header, also known as the envelope sender or the Return-Path address.
SenderObjectId	string	Sender email address in the from header, which is visible to email recipients on their email clients.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
Subject	string	Email subject field.
TenantId	string	The Log Analytics workspace ID
ThreatClassification	string	Indicates the threat classification of the mail
ThreatNames	string	Sender email address in the from header, which is visible to email recipients on their email clients.
ThreatTypes	string	Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats.
TimeGenerated	datetime	Date and time (UTC) when the record was generated.
To	dynamic	Indicates the addresses which are listed in To fields of an email
Type	string	The name of the table
UrlCount	int	Number of embedded URLs in the email.
UserLevelAction	string	Action taken on the email in response to matches to a mailbox policy defined by the recipient.
UserLevelPolicy	string	End user mailbox policy that triggered the action taken on the email.

Solutions (11)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Microsoft Defender XDR

Content Items Using This Table (289)

Analytic Rules (10)

In solution Microsoft Business Applications:

Analytic Rule	Selection Criteria
Dataverse - Terminated employee exfiltration over email

In solution Threat Intelligence:

Analytic Rule	Selection Criteria
TI Map URL Entity to EmailUrlInfo
TI map Domain entity to EmailEvents
TI map Domain entity to EmailUrlInfo
TI map Email entity to EmailEvents

In solution Threat Intelligence (NEW):

Analytic Rule	Selection Criteria
TI Map URL Entity to EmailUrlInfo
TI map Domain entity to EmailEvents
TI map Domain entity to EmailUrlInfo
TI map Email entity to EmailEvents

Standalone Content:

Analytic Rule	Selection Criteria
Star Blizzard C2 Domains August 2022

Hunting Queries (270)

In solution Business Email Compromise - Financial Fraud:

Hunting Query	Selection Criteria
Email Forwarding Configuration with SAP download

In solution Microsoft Defender XDR:

Hunting Query	Selection Criteria
Automated email notifications and suspicious sign-in activity
Bad email percentage of Inbound emails
Bulk Emails by Sender Bulk Complaint level
Calculate overall MDO efficacy
CompAuth Failure Trend
DKIM Failure Trend
DMARC Failure Trend
Determine Successfully Delivered Phishing Emails by top IP Addresses
Determine Successfully Delivered Phishing Emails to Inbox/Junk folder.
Email Top 10 Domains sending Spam
Email Top 10 Targeted Users (Spam)
Email Top 15 Domains sending Spam with Additional Details
Email Top 15 Targeted Users (Spam) with Additional Details
Email Top Domains sending Malware
Email Top Domains sending Phish
Email bombing attacks
Files share contents and suspicious sign-in activity
Hunt for email bombing attacks
Impersonation Detections Trend
Impersonation Detections by Detection Technology
Impersonation Detections by Detection Technology Trend
MDO Threat Protection Detections trend over time
Malware Detections Trend
Malware Detections by Detection technology
Malware Detections by Detection technology Trend
Malware Detections by delivery location
Message from an Accepted Domain with DMARC TempError
Phish Detections (High) by delivery location
Phish Detections (Normal) by delivery location
Phish Detections Trend
Phish Detections by Detection technology
Phish Detections by Detection technology Trend
Phish Detections by delivery location trend
Quarantine Phish Reason
Quarantine Phish Reason trend
Quarantine Spam Reason
Quarantine Spam Reason trend
Quarantine releases by Detection Types
SPF Failure Trend
Spam Detections (High) by delivery location
Spam Detections (Normal) by delivery location
Spam Detections by Detection technology
Spam and Phish allowed to inbox by Admin Overrides
Spam and Phish allowed to inbox by User Overrides
Spam detection by IP and its location
Spam detection by delivery location
Spam detection technologies
Spam detection trend
Spoof Detections Trend
Spoof Detections by Detection Technology
Spoof Detections by Detection Technology Trend
Spoofing attempts from Specific Domains
Top 10 External Senders (Spam)
Top 10 domains sending Bulk email
Top Domains Outbound with Emails with Threats Inbound (Partner BEC)
Top Malware Families
Top Spoof DMARC detections by Sender domain (P1/P2)
Top Spoof external domain detections by Sender domain (P1/P2)
Top Spoof intra-org detections by Sender domain (P1/P2)
Top Users receiving Malware
Top Users receiving Phish
Top outbound recipient domains sending inbound emails with threats
Total Emails with Admin Overrides (Allow)
Total Emails with Admin Overrides (Block)
Total Emails with User Overrides (Allow)
Total Emails with User Overrides (Block)
Total number of detections by MDO
User Email Submissions (FN) - Top Inbound P2 Senders
User Email Submissions (FN) - Top Inbound P2 Senders domains
Zero-day Malware Detections Trend
Zero-day Phish Detections Trend

GitHub Only:

Hunting Query	Selection Criteria
Attacked more than x times average
Attacked more than x times average
Authentication failures by time and authentication type
Authentication failures by time and authentication type
Automated email notifications and suspicious sign-in activity
Bad email percentage of Inbound emails
Bazacall Emails
Bulk Emails by Sender Bulk Complaint level
Calculate overall MDO efficacy
Campaign with suspicious keywords
Campaign with suspicious keywords
CompAuth Failure Trend
Custom detection-Emails with QR from non-prevalent senders
Custom detection-Emails with QR from non-prevalent senders
DKIM Failure Trend
DMARC Failure Trend
Detections by detection methods
Detections by detection methods
Display Name - Spoof and Impersonation
Display Name - Spoof and Impersonation
Email Top 10 Domains sending Spam
Email Top 10 Targeted Users (Spam)
Email Top 15 Domains sending Spam with Additional Details
Email Top 15 Targeted Users (Spam) with Additional Details
Email Top Domains sending Malware
Email Top Domains sending Phish
Email bombing attacks
Email containing malware sent by an internal sender
Email containing malware sent by an internal sender
Email malware detection report
Email malware detection report
Email sender IP address Geo location information
Email sender IP address Geo location information
Emails delivered having URLs from QR codes
Emails delivered having URLs from QR codes
Emails with QR codes and suspicious keywords in subject
Emails with QR codes and suspicious keywords in subject
Emails with QR codes from non-prevalent sender
Emails with QR codes from non-prevalent sender
Empty Sender Phish Delivered to Inbox
Fake Replies
Good emails from senders with bad patterns
Good emails from senders with bad patterns
High Confidence Phish Released
High Confidence Phish Released
Hunt for email bombing attacks
Hunt for email conversation take over attempts
Hunt for email conversation take over attempts
Hunting for sender patterns
Hunting for sender patterns
Hunting for user signals-clusters
Hunting for user signals-clusters
IcedId attachments
Impersonation Detections Trend
Impersonation Detections by Detection Technology
Impersonation Detections by Detection Technology Trend
Inbound emails with QR code URLs
Inbound emails with QR code URLs
LemonDuck-email-subjects
Listing Email Remediation Actions via Explorer
Listing Email Remediation Actions via Explorer
Local time to UTC time conversion
Local time to UTC time conversion
MDO Threat Protection Detections trend over time
MDO daily detection summary report
MDO daily detection summary report
MDO_CountOfRecipientsEmailaddressbySubject
MDO_CountOfRecipientsEmailaddressbySubject
MDO_CountOfSendersEmailaddressbySubject
MDO_CountOfSendersEmailaddressbySubject
MDO_Countofrecipientsemailaddressesbysubject
MDO_Countofrecipientsemailaddressesbysubject
MDO_SummaryOfSenders
MDO_SummaryOfSenders
Mail reply to new domain
Mail reply to new domain
Mailflow by directionality
Mailflow by directionality
Malicious Emails with QR code Urls
Malicious Emails with QR code Urls
Malicious email senders
Malicious email senders
Malicious emails detected per day
Malicious emails detected per day
Malicious mails by sender IPs
Malicious mails by sender IPs
Malware Detections Trend
Malware Detections by Detection technology
Malware Detections by Detection technology Trend
Malware Detections by delivery location
Message from an Accepted Domain with DMARC TempError
Personalized campaigns based on the first few keywords
Personalized campaigns based on the first few keywords
Personalized campaigns based on the last few keywords
Personalized campaigns based on the last few keywords
Phish Detections (High) by delivery location
Phish Detections (Normal) by delivery location
Phish Detections Trend
Phish Detections by Detection technology
Phish Detections by Detection technology Trend
Phish Detections by delivery location trend
Phish and Malware received by user vs total amount of email
Punycode lookalikes
Punycode lookalikes
Quarantine Phish Reason
Quarantine Phish Reason trend
Quarantine Release Email Details
Quarantine Release Email Details
Quarantine Spam Reason
Quarantine Spam Reason trend
Quarantine releases by Detection Types
SPF Failure Trend
Safe Attachments detections
Safe Attachments detections
SafeLinks URL detections
SafeLinks URL detections
Sender recipient contact establishment
Sender recipient contact establishment
Spam Detections (High) by delivery location
Spam Detections (Normal) by delivery location
Spam Detections by Detection technology
Spam and Phish allowed to inbox by Admin Overrides
Spam and Phish allowed to inbox by User Overrides
Spam detection by IP and its location
Spam detection by delivery location
Spam detection technologies
Spam detection trend
Spoof Detections Trend
Spoof Detections by Detection Technology
Spoof Detections by Detection Technology Trend
Spoof and impersonation detections by sender IP
Spoof and impersonation detections by sender IP
Spoof and impersonation phish detections
Spoof and impersonation phish detections
Spoof attempts with auth failure
Spoof attempts with auth failure
Suspicious Google Doc Links
SuspiciousUrlClicked
Threat actor Phosphorus masquerading as conference organizers
Threat actor Phosphorus masquerading as conference organizers (1)
Threat actor Phosphorus masquerading as conference organizers (2)
Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)
Top 10 Domains sending Malicious Emails (Malware+Phish+Spam)
Top 10 External Senders (Malware)
Top 10 External Senders (Malware)
Top 10 External Senders (Phish)
Top 10 External Senders (Phish)
Top 10 External Senders (Spam)
Top 10 External Senders (Spam)
Top 10 External Senders (Spam)
Top 10 Targeted Users (Malware+Phish+Spam)
Top 10 Targeted Users (Malware+Phish+Spam)
Top 10 URL domains attacking organization
Top 10 URL domains attacking organization
Top 10 domains sending Bulk email
Top 10% of most attacked users
Top 10% of most attacked users
Top 100 malicious email senders
Top 100 malicious email senders
Top 100 senders
Top 100 senders
Top Domains Outbound with Emails with Threats Inbound (Partner BEC)
Top Malware Families
Top Spoof DMARC detections by Sender domain (P1/P2)
Top Spoof external domain detections by Sender domain (P1/P2)
Top Spoof intra-org detections by Sender domain (P1/P2)
Top Users receiving Malware
Top Users receiving Phish
Top external malicious senders
Top external malicious senders
Top outbound recipient domains sending inbound emails with threats
Top policies performing admin overrides
Top policies performing admin overrides
Top policies performing user overrides
Top policies performing user overrides
Top targeted users
Top targeted users
Total Emails with Admin Overrides (Allow)
Total Emails with Admin Overrides (Block)
Total Emails with User Overrides (Allow)
Total Emails with User Overrides (Block)
Total number of detections by MDO
User Email Submissions (FN) - Top Inbound P2 Senders
User Email Submissions (FN) - Top Inbound P2 Senders domains
User clicks on malicious inbound emails	`ActionType == "ClickAllowed"`
User clicks on malicious inbound emails	`ActionType == "ClickAllowed"`
Zero day threats
Zero day threats
Zero-day Malware Detections Trend
Zero-day Phish Detections Trend
detect-archive-exfiltration-to-competitor
insider-threat-detection-queries (10)
jar-attachments
logon-attempts-after-malicious-email
powershell-activity-after-email-from-malicious-sender
referral-phish-emails
referral-phish-emails
snip3-aviation-targeting-emails

Workbooks (9)

In solution MaturityModelForEventLogManagementM2131:

Workbook	Selection Criteria
MaturityModelForEventLogManagement_M2131

In solution Microsoft Defender XDR: ActionType in "AdminSubmissionSubmitted,AttackSimUserSubmission,ClickBlocked,Malware ZAP,Phish ZAP,Spam ZAP,UserSubmission"
ActionType == "Automated Remediation"
ActionType contains "Submission"
ActionType contains "UserSubmission"
ActionType contains "ZAP"
ActionType has "Malware ZAP"
ActionType has "Phish ZAP"
ActionType has "Spam ZAP"
ActionType has "ZAP"
ActionType has_any "ClickAllowed"
ActionType has_any "ClickBlocked"
ActionType has_any "UrlErrorPage"
ActionType has_any "UrlScanInProgress"

Workbook
MicrosoftDefenderForOffice365detectionsandinsights

In solution Microsoft Defender for Office 365:

Workbook	Selection Criteria
MicrosoftDefenderForOffice365

In solution MicrosoftPurviewInsiderRiskManagement: ActionType in "Add member to role,Add user,InteractiveLogon,RemoteInteractiveLogon,Reset user password,ResourceAccess,Sign-in,Update user"

Workbook
InsiderRiskManagement

In solution NISTSP80053:

Workbook	Selection Criteria
NISTSP80053

In solution ZeroTrust(TIC3.0):

Workbook	Selection Criteria
ZeroTrustTIC3