FileMaliciousContentInfo

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Files that were processed by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams.

Attribute	Value
Category	Security, XDR
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes
Azure Monitor Tables Reference	View Documentation
Defender XDR Advanced Hunting Schema	View Documentation

Schema
Schema References
Solutions
Content Items

Schema (21 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
DetectionMethods	string	Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats.
DocumentID	string	Unique identifier of the file.
FileCreationTime	datetime	Timestamp of the file creation.
FileName	string	Name of the file that the recorded action was applied to.
FileOwnerDisplayName	string	Account recorded as owner of the file.
FileOwnerUpn	string	Account recorded as owner of the file
FileSize	long	Size of the file in bytes.
FolderPath	string	Folder containing the file that the recorded action was applied to.
LastModifiedTime	datetime	Date and time the item, or related metadata was last modified.
LastModifyingAccountUpn	string	Account that last modified this file.
ReportId	string	Unique identifier for the event.
SHA256	string	SHA-256 of the file that the recorded action was applied to.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TenantId	string	The Log Analytics workspace ID
ThreatNames	string	Detection name for malware or other threats found.
ThreatTypes	string	Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats.
TimeGenerated	datetime	Date and time (UTC) when the record was generated.
Type	string	The name of the table
Workload	string	Information about the workload from which the URL originated from.

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Microsoft Defender XDR

Content Items Using This Table (19)

Hunting Queries (18)

In solution Microsoft Defender XDR:

Hunting Query	Selection Criteria
File Malware Detections Over Time (SharePoint, OneDrive and Teams)
File Malware Detections by Location (SharePoint, OneDrive and Teams)
File Malware Detections by Workload (SharePoint, OneDrive and Teams)
File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)
File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)
File Scanning Coverage (SharePoint, OneDrive and Teams)
Malicious files shared in Microsoft Teams	`Workload == "MicrosoftTeams"`
Teams File Protection Summary
Top File Owners Holding Malware (SharePoint, OneDrive and Teams)

GitHub Only:

Hunting Query	Selection Criteria
File Malware Detections Over Time (SharePoint, OneDrive and Teams)
File Malware Detections by Location (SharePoint, OneDrive and Teams)
File Malware Detections by Workload (SharePoint, OneDrive and Teams)
File Malware Top Families by Microsoft Defender Detonation (SharePoint, OneDrive and Teams)
File Malware Top Families by SharePoint Antivirus (SharePoint, OneDrive and Teams)
File Scanning Coverage (SharePoint, OneDrive and Teams)
Malicious files shared in Microsoft Teams	`Workload == "MicrosoftTeams"`
Teams File Protection Summary
Top File Owners Holding Malware (SharePoint, OneDrive and Teams)

Workbooks (1)