Defender-EmailUrlInfo
any: Email URL observed
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
Url | 1 detection rule | Kusto |
Representative record #
{
"NetworkMessageId": "52fc849a-351b-4f7a-7db9-08deda4abae8",
"ReportId": "52fc849a-351b-4f7a-7db9-08deda4abae8-4843662952969085716",
"Timestamp": "2026-07-05T04:06:05Z",
"Url": "https://aka.ms/invoice-billing",
"UrlChainPosition": 0,
"UrlDomain": "aka.ms",
"UrlLocation": "Attachment"
}
Detection Patterns #
Common Indicators #
Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
SourceSeverity (kusto rule field) | eq | High | 1 rule | kusto |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Kusto #
T1566T1566