EmailUrlInfo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Information about URLs on emails

Attribute	Value
Category	Defender
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes
Azure Monitor Tables Reference	View Documentation
Defender XDR Advanced Hunting Schema	View Documentation

Schema
Schema References
Solutions
Connectors
Content Items

Schema (13 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
NetworkMessageId	string	Email unique identifier generated by Office 365
ReportId	string	Unique identifier for the event
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
TimeGenerated	datetime	Date and time (UTC) when the record was generated
Type	string	The name of the table
Url	string	Information about URLs on Office 365 emails
UrlChainId	string	Identifier for the chain of URLs associated with the email
UrlChainPosition	int	Position of the URL within the URL chain
UrlDomain	string	Domain part of the Url
UrlLocation	string	Indicates which part of the email the URL is located

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (8)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Microsoft Defender XDR

Content Items Using This Table (46)

Analytic Rules (6)

In solution Threat Intelligence:

Analytic Rule	Selection Criteria
TI Map URL Entity to EmailUrlInfo
TI map Domain entity to EmailUrlInfo

In solution Threat Intelligence (NEW):

Analytic Rule	Selection Criteria
TI Map Domain entity to EmailUrlInfo
TI Map URL Entity to EmailUrlInfo

In solution Visa Threat Intelligence (VTI):

Analytic Rule	Selection Criteria
VTI - High Severity Domain Collision Detection

Standalone Content:

Analytic Rule	Selection Criteria
Star Blizzard C2 Domains August 2022

Hunting Queries (33)

In solution Microsoft Defender XDR:

Hunting Query	Selection Criteria
Malicious Email Campaigns by Recipient URL Clicks
Message with URL listed on OpenPhish delivered into Inbox
Potential OAuth phishing email delivered into Inbox
QR Code URL Detections Trend
URL Threat Protection Summary

Standalone Content:

Hunting Query	Selection Criteria
Raw IP Address Used as URL Domain

GitHub Only:

Hunting Query	Selection Criteria
Appspot Phishing Abuse
Appspot Phishing Abuse
Appspot Phishing Abuse
Custom detection-Emails with QR from non-prevalent senders
Custom detection-Emails with QR from non-prevalent senders
Detect DNS obfuscation using @ symbol	`Url contains "@"`
Emails containing links to IP addresses
Emails containing links to IP addresses
Hunt for malicious URLs using external IOC source
Hunt for malicious URLs using external IOC source
IcedId email delivery
Malicious Email Campaigns by Recipient URL Clicks
Malicious Emails with QR code Urls	`UrlLocation == "QRCode"`
Malicious Emails with QR code Urls	`UrlLocation == "QRCode"`
Message with URL listed on OpenPhish delivered into Inbox
PhishingEmailUrlRedirector
PhishingEmailUrlRedirector (1)
PhishingEmailUrlRedirector (1)
Potential OAuth phishing email delivered into Inbox
Punycode lookalikes
Punycode lookalikes
QR Code URL Detections Trend
StrRAT-Email-Delivery	`UrlDomain has_any "metroscaffingltg.co.uk"`
Suspicious Google Doc Links	`Url startswith "https://docs.google.com/document/"`
URL Threat Protection Summary
URLs by location
URLs by location

Workbooks (7)

In solution MaturityModelForEventLogManagementM2131:

Workbook	Selection Criteria
MaturityModelForEventLogManagement_M2131

In solution Microsoft Defender XDR:

Workbook	Selection Criteria
MicrosoftDefenderForOffice365detectionsandinsights

In solution Microsoft Defender for Office 365:

Workbook	Selection Criteria
MicrosoftDefenderForOffice365

In solution ZeroTrust(TIC3.0):

Workbook	Selection Criteria
ZeroTrustTIC3