Defender-MessageUrlInfo

any: Teams message URL observed

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

Table: MessageUrlInfo

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`Url`	1 detection rule	Kusto

Detection Patterns #

Defender-MessageEvents any: Teams message processedORDefender-MessageUrlInfo any: Teams message URL observed

2 rules

Kusto

Detect external user sending suspicious link to multiple users (source)

Robbe Van den Daele

Detect Malicious Teams Message (source)

Robbe Van den Daele

References #

Microsoft Defender XDR: advanced hunting reference