capability

MDO Advanced Hunting

Defender for Office 365 Plan 2 exposes email and collaboration telemetry in Microsoft Defender XDR advanced hunting for KQL-based investigation across messages, URLs, attachments, campaigns, clicks, and post-delivery actions.

capabilitiesCurrent

Relationships

Configuration Methods

Method	Support	Reference or Gap
Portal	Supported	Reference
PowerShell	Supported	Reference
REST API	Supported	Reference
Graph	Supported	Reference
ARM	Gap	No ARM resource is recorded for this capability.
Bicep	Gap	No Bicep resource is recorded for this capability.
Terraform	Gap	Advanced hunting query execution is API/script automation, not Terraform desired state.
GitHub Actions	Supported	Reference
Azure DevOps	Supported	Reference

Related KQL

Pivot from suspicious email to URL clicks

Find delivered inbound messages from a suspicious sender domain, join URL metadata, then pivot into user click activity.

template

intermediatephishinguser-compromise

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents EmailUrlInfo UrlClickEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

let lookback = {lookback};
let senderDomain = "{sender_domain}";
let suspiciousMessages = EmailEvents
| where Timestamp > ago(lookback)
| where EmailDirection == "Inbound"
| where SenderFromDomain =~ senderDomain
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes;
suspiciousMessages
| join kind=leftouter (
    EmailUrlInfo
    | project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| join kind=leftouter (
    UrlClickEvents
    | where Timestamp > ago(lookback)
    | project ClickTimestamp=Timestamp, NetworkMessageId, AccountUpn, Url, ActionType, IsClickedThrough, ThreatTypes
) on NetworkMessageId, Url
| order by Timestamp desc, ClickTimestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing investigation themes with tenant-specific placeholders and current MDO table names.

Summarize inbound email authentication failures

Parse EmailEvents authentication details to summarize SPF, DKIM, DMARC, and composite authentication outcomes by sender domain.

template

intermediatephishing

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: EmailEvents
License context: Microsoft Defender for Office 365 Plan 2

kql

EmailEvents
| where Timestamp > ago({lookback})
| where EmailDirection == "Inbound"
| extend Auth = parse_json(AuthenticationDetails)
| extend SPF=tostring(Auth.SPF), DKIM=tostring(Auth.DKIM), DMARC=tostring(Auth.DMARC), CompAuth=tostring(Auth.CompAuth)
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 5) by SenderFromDomain, SPF, DKIM, DMARC, CompAuth, DeliveryAction
| order by Messages desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing and Microsoft 365 compromise themes; converted to a generalized authentication summary.