Defender-EmailAttachmentInfo

ActionTypeTitleSampleRule
anyEmail attachment observedYN

any: Email attachment observed

#
Table
EmailAttachmentInfo

Example Event #

{
  "FileExtension": ".pdf",
  "FileName": "G173439708.pdf",
  "FileSize": 204531,
  "FileSize@odata.type": "#Int64",
  "FileType": "pdf",
  "NetworkMessageId": "beaf631f-c39b-40d9-e71c-08deeb887f5b",
  "RecipientEmailAddress": "adminuser@example.onmicrosoft.com",
  "RecipientObjectId": "11111111-1111-1111-1111-111111111111",
  "ReportId": "beaf631f-c39b-40d9-e71c-08deeb887f5b-1200339958981992029-5e21cd1556296a2d65335f3d506078a05d189c2090ac6b7671b0d24c5a239823-1",
  "SHA256": "5e21cd1556296a2d65335f3d506078a05d189c2090ac6b7671b0d24c5a239823",
  "SenderDisplayName": "Microsoft",
  "SenderFromAddress": "microsoft-noreply@microsoft.com",
  "Timestamp": "2026-07-27T02:41:24Z"
}

References #