Defender-EmailEvents

any: Email processed

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table: EmailEvents

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`DeliveryAction`	9 detection rules	Kusto
`EmailDirection`	2 detection rules	Kusto
`RecipientEmailAddress`	2 detection rules	Kusto
`SenderFromAddress`	2 detection rules	Kusto
`AttachmentCount`	1 detection rule	Kusto
`Connectors`	1 detection rule	Kusto
`SenderMailFromAddress`	1 detection rule	Kusto

Representative record #

{
  "AttachmentCount": 1,
  "AuthenticationDetails": {
    "SPF": "pass",
    "DKIM": "pass",
    "DMARC": "pass",
    "CompAuth": "pass"
  },
  "Cc@odata.type": "#Collection(String)",
  "DeliveryAction": "Delivered",
  "DeliveryLocation": "Inbox/folder",
  "EmailClusterId": 3519904447,
  "EmailClusterId@odata.type": "#Int64",
  "EmailDirection": "Inbound",
  "EmailLanguage": "en",
  "EmailSize": 560111,
  "EmailSize@odata.type": "#Int64",
  "InternetMessageId": "<9e0b262d-ba0f-41dd-a2f9-4b6818411af8@az.eastus2.microsoft.com>",
  "IsFirstContact": 0,
  "IsFirstContact@odata.type": "#SByte",
  "LatestDeliveryAction": "Delivered",
  "LatestDeliveryLocation": "Inbox/folder",
  "NetworkMessageId": "beaf631f-c39b-40d9-e71c-08deeb887f5b",
  "RecipientDomain": "example.onmicrosoft.com",
  "RecipientEmailAddress": "adminuser@example.onmicrosoft.com",
  "RecipientObjectId": "11111111-1111-1111-1111-111111111111",
  "ReportId": "beaf631f-c39b-40d9-e71c-08deeb887f5b-1200339958981992029-1",
  "SenderDisplayName": "Microsoft",
  "SenderFromAddress": "microsoft-noreply@microsoft.com",
  "SenderFromDomain": "microsoft.com",
  "SenderIPv6": "2001:db8::10",
  "SenderMailFromAddress": "microsoft-noreply@microsoft.com",
  "SenderMailFromDomain": "microsoft.com",
  "Subject": "Your Microsoft invoice G173439708 is ready",
  "Timestamp": "2026-07-27T02:41:24Z",
  "To": [
    "adminuser@example.onmicrosoft.com"
  ],
  "To@odata.type": "#Collection(String)",
  "UrlCount": 18
}

Detection Patterns #

Ti Map Domain Entity

Defender-EmailEvents any: Email processedORDefender-EmailUrlInfo any: Email URL observed

4 rules

Kusto

TI Map Domain entity to EmailUrlInfo (source)

TI map Domain entity to EmailUrlInfo (source)

TI Map URL Entity to EmailUrlInfo (source)

Show 1 more (4 total) on the rules page

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Kusto #

Star Blizzard C2 Domains August 2022 source high: Identifies a match across various data feeds for domains related to an actor tracked by Microsoft as Star Blizzard.T1566
Dataverse - Terminated employee exfiltration over email source high: This query identifies Dataverse exfiltration via email by terminated employees.T1567, T1639
Possible Phishing with CSL and Network Sessions source medium: This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. If your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.T1102, T1566

Show 5 more (8 total) on the rules page

References #

Microsoft Defender XDR: advanced hunting reference