MessagePostDeliveryEvents

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Security events that occurred after the delivery of a Microsoft Teams message in your organization

Attribute	Value
Category	Security, XDR
Basic Logs Eligible	✓ Yes (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Lake-Only Ingestion	✓ Yes
Azure Monitor Tables Reference	View Documentation
Defender XDR Advanced Hunting Schema	View Documentation

Schema
Schema References
Solutions
Content Items

Schema (20 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
Action	string	Action taken on the message: Blocked, Moved to quarantine
ActionResult	string	Result of the action
ActionTrigger	string	Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery
ActionType	string	Type of activity that triggered the event: Manual remediation, Phish ZAP, Malware ZAP
ConfidenceLevel	dynamic	List of confidence levels for each threat type identified
DetectionMethods	string	Methods used to detect malware, phishing, or other threats found in the message
IsExternalThread	bool	Indicates if there are external recipients in the thread (1) or none (0)
LatestDeliveryLocation	string	Last known location of the message
RecipientDetails	dynamic	Array of recipient data (RecipientSmtpAddress, RecipientDisplayName, RecipientType, RecipientObjectId)
ReportId	string	Unique identifier for the event
SafetyTip	string	The safety tip that has been added on a message, if any
SenderEmailAddress	string	Email address of the sender
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
TeamsMessageId	string	Unique identifier for the message, as generated by Microsoft 365
TenantId	string	The Log Analytics workspace ID
ThreatTypes	string	Verdict from the filtering stack on whether the message contains malware, phishing, or other threats
TimeGenerated	datetime	Date and time (UTC) when the record was generated.
Type	string	The name of the table

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Microsoft Defender XDR

Content Items Using This Table (17)

Hunting Queries (16)

In solution Microsoft Defender XDR:

Hunting Query	Selection Criteria
Potentially malicious URL click in Teams
Teams Malware ZAP
Teams Phish ZAP
Teams Spam ZAP
Teams message ZAPed with the same URL in Email
Teams post delivery events daily trend
Top Microsoft Teams Senders Removed by Zero-Hour Auto Purge
URL click on URLs in ZAP-d Teams messages

GitHub Only:

Hunting Query	Selection Criteria
Potentially malicious URL click in Teams
Teams Malware ZAP
Teams Phish ZAP
Teams Spam ZAP
Teams message ZAPed with the same URL in Email
Teams post delivery events daily trend
Top Microsoft Teams Senders Removed by Zero-Hour Auto Purge
URL click on URLs in ZAP-d Teams messages

Workbooks (1)