table

EmailAttachmentInfo

EmailAttachmentInfo contains information about attachments on emails processed by Microsoft Defender for Office 365.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproduct Microsoft Graph Security API
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi EmailEvents
Related tabletable FileMaliciousContentInfo
Related tabletable

Schema

Field	Type	Description	Copy
`Timestamp`	datetime	Date and time when the event was recorded.
`NetworkMessageId`	string	Unique identifier for the email, generated by Microsoft 365.
`SenderFromAddress`	string	Sender email address in the visible From header.
`SenderDisplayName`	string	Display name shown for the sender.
`SenderObjectId`	string	Microsoft Entra ID object ID for the sender account.
`RecipientEmailAddress`	string	Email address of the recipient, or the recipient after distribution list expansion.
`RecipientObjectId`	string	Microsoft Entra ID object ID for the recipient account.
`FileName`	string	Name of the file that the recorded action was applied to.
`FileType`	string	File extension type.
`FileExtension`	string	File extension of the attachment.
`SHA256`	string	SHA-256 hash of the file when populated.
`FileSize`	long	Size of the file in bytes.
`ThreatTypes`	string	Verdict from the email filtering stack.
`ThreatNames`	string	Detection name for malware or other threats found.
`DetectionMethods`	string	Methods used to detect malware, phishing, or other threats.
`ReportId`	string	Event identifier based on a repeating counter.
`AdditionalFields`	string	Additional information about the entity or event.