Defender-EmailUrlInfo
| ActionType | Title | Sample | Rule |
|---|---|---|---|
| any | Email URL observed | Y | Y |
any: Email URL observed
#Example Event #
{
"NetworkMessageId": "52fc849a-351b-4f7a-7db9-08deda4abae8",
"ReportId": "52fc849a-351b-4f7a-7db9-08deda4abae8-4843662952969085716",
"Timestamp": "2026-07-05T04:06:05Z",
"Url": "https://aka.ms/invoice-billing",
"UrlChainPosition": 0,
"UrlDomain": "aka.ms",
"UrlLocation": "Attachment"
}
Detection Patterns #
Common Indicators #
Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.
| Field | Kind | Value | Rules | Vendors |
|---|---|---|---|---|
Url (kusto rule field) | eq | EmailUrls | 2 rules | kusto |
Url (kusto rule field) | is_not_null | | 3 rules | kusto |
DomainName (kusto rule field) | is_not_null | | 2 rules | kusto |
EmailUrlInfo_TimeGenerated (kusto rule field) | cross_field_compare | ExpirationDateTime | 2 rules | kusto |
IndicatorType (kusto rule field) | eq | url | 2 rules | kusto |
UrlDomain (kusto rule field) | is_not_null | | 2 rules | kusto |
ObservableKey (kusto rule field) | eq | domain-name:value | 1 rule | kusto |
SourceSeverity (kusto rule field) | eq | High | 1 rule | kusto |
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1566T1566