Defender-EmailEvents
| ActionType | Title | Sample | Rule |
|---|---|---|---|
| any | Email processed | Y | Y |
any: Email processed
#Example Event #
{
"AttachmentCount": 1,
"AuthenticationDetails": {
"SPF": "pass",
"DKIM": "pass",
"DMARC": "pass",
"CompAuth": "pass"
},
"Cc@odata.type": "#Collection(String)",
"DeliveryAction": "Delivered",
"DeliveryLocation": "Inbox/folder",
"EmailClusterId": 3519904447,
"EmailClusterId@odata.type": "#Int64",
"EmailDirection": "Inbound",
"EmailLanguage": "en",
"EmailSize": 560111,
"EmailSize@odata.type": "#Int64",
"InternetMessageId": "<9e0b262d-ba0f-41dd-a2f9-4b6818411af8@az.eastus2.microsoft.com>",
"IsFirstContact": 0,
"IsFirstContact@odata.type": "#SByte",
"LatestDeliveryAction": "Delivered",
"LatestDeliveryLocation": "Inbox/folder",
"NetworkMessageId": "beaf631f-c39b-40d9-e71c-08deeb887f5b",
"RecipientDomain": "example.onmicrosoft.com",
"RecipientEmailAddress": "adminuser@example.onmicrosoft.com",
"RecipientObjectId": "11111111-1111-1111-1111-111111111111",
"ReportId": "beaf631f-c39b-40d9-e71c-08deeb887f5b-1200339958981992029-1",
"SenderDisplayName": "Microsoft",
"SenderFromAddress": "microsoft-noreply@microsoft.com",
"SenderFromDomain": "microsoft.com",
"SenderIPv6": "2001:db8::10",
"SenderMailFromAddress": "microsoft-noreply@microsoft.com",
"SenderMailFromDomain": "microsoft.com",
"Subject": "Your Microsoft invoice G173439708 is ready",
"Timestamp": "2026-07-27T02:41:24Z",
"To": [
"adminuser@example.onmicrosoft.com"
],
"To@odata.type": "#Collection(String)",
"UrlCount": 18
}
Detection Patterns #
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Active (kusto rule field) | eq | true | 4 rules | kusto |
RecipientEmailAddress (kusto rule field) | is_not_null | | 4 rules | kusto |
SenderFromAddress (kusto rule field) | is_not_null | | 4 rules | kusto |
DomainName (kusto rule field) | is_not_null | | 3 rules | kusto |
Url (kusto rule field) | eq | EmailUrls | 2 rules | kusto |
Url (kusto rule field) | is_not_null | | 3 rules | kusto |
ValidUntil (kusto rule field) | is_null | | 3 rules | kusto |
EmailEvents_TimeGenerated (kusto rule field) | cross_field_compare | ExpirationDateTime | 2 rules | kusto |
EmailEvents_TimeGenerated (kusto rule field) | cross_field_compare | ValidUntil | 2 rules | kusto |
EmailUrlInfo_TimeGenerated (kusto rule field) | cross_field_compare | ExpirationDateTime | 2 rules | kusto |
IndicatorType (kusto rule field) | eq | url | 2 rules | kusto |
TI_EmailAddress (kusto rule field) | eq | RecipientAddresses | 2 rules | kusto |
TI_EmailAddress (kusto rule field) | eq | SenderAddresses | 2 rules | kusto |
UrlDomain (kusto rule field) | is_not_null | | 2 rules | kusto |
DestinationHostname (kusto rule field) | is_not_null | | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1566T1567, T1639T1102, T1566