Unique identifier for the email, generated by Microsoft 365.
InternetMessageId
string
Public-facing identifier set by the sending email system.
SenderMailFromAddress
string
Sender address from the MAIL FROM header, also known as the envelope sender.
SenderFromAddress
string
Sender email address in the visible From header.
SenderDisplayName
string
Display name shown for the sender.
SenderObjectId
string
Microsoft Entra ID object ID for the sender account.
SenderMailFromDomain
string
Sender domain from the MAIL FROM header.
SenderFromDomain
string
Sender domain from the visible From header.
SenderIPv4
string
IPv4 address of the last detected mail server that relayed the message.
SenderIPv6
string
IPv6 address of the last detected mail server that relayed the message.
RecipientEmailAddress
string
Email address of the recipient.
RecipientObjectId
string
Microsoft Entra ID object ID for the recipient account.
Subject
string
Subject of the email.
EmailClusterId
long
Identifier for a group of similar emails clustered through content analysis.
EmailDirection
string
Direction of the message relative to the organization, such as inbound, outbound, or intra-org.
DeliveryAction
string
Delivery action of the email, such as Delivered, Junked, Blocked, or Replaced.
DeliveryLocation
string
Location where the email was delivered.
ThreatTypes
string
Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats.
ThreatNames
string
Detection name for malware or other threats found.
DetectionMethods
string
Methods used to detect malware, phishing, or other threats.
ConfidenceLevel
string
Spam or phishing confidence level assigned by filtering.
BulkComplaintLevel
int
Bulk complaint level assigned to email from bulk senders.
EmailAction
string
Final action applied to the message based on verdicts, policies, and user actions.
EmailActionPolicy
string
Policy category that determined the final email action.
EmailActionPolicyGuid
string
Unique identifier for the policy that determined the final action.
AuthenticationDetails
string
Authentication verdicts such as DMARC, DKIM, SPF, or composite authentication.
AttachmentCount
int
Number of attachments in the email.
UrlCount
int
Number of embedded URLs in the email.
EmailLanguage
string
Detected language of the email content.
Connectors
string
Custom mail flow routing instructions or connectors that affected the message.
OrgLevelAction
string
Action taken because of an organization-level policy match.
OrgLevelPolicy
string
Organization-level policy that triggered the action.
UserLevelAction
string
Action taken because of a user mailbox policy match.
UserLevelPolicy
string
User mailbox policy that triggered the action.
ReportId
string
Event identifier based on a repeating counter.
AdditionalFields
string
Additional event or entity details.
LatestDeliveryLocation
string
Last known location of the email; not available in the Streaming API.
LatestDeliveryAction
string
Last known delivery action attempted by the service or by admin remediation; not available in the Streaming API.
DistributionList
string
Top-level distribution list to which the email was sent, when applicable.
ExchangeTransportRule
string
Mail flow rule that acted on the message while it was in transit.
ForwardingInformation
string
JSON-formatted forwarding details, including forwarding user and forwarding type.
Context
string
Protection context in which the detection ran.
To
string
Addresses listed in the To header.
Cc
string
Addresses listed in the Cc header.
ThreatClassification
string
Threat classification assigned to the email.
RecipientDomain
string
Domain portion of the recipient address.
EmailSize
long
Size of the email message in bytes.
IsFirstContact
int
Indicates whether this was the first contact between the sender and recipient.
Sample KQL
Inbound phishing delivery by sender domain
Summarize inbound messages with phishing verdicts and where they landed.
kql
EmailEvents
| where Timestamp > ago(7d)
| where EmailDirection == "Inbound"
| where ThreatTypes has "Phish" or ThreatClassification has "Phish"
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress) by SenderFromDomain, DeliveryAction, DeliveryLocation
| order by Messages desc
Messages with URL and attachment exposure
Identify messages that combine embedded links and attachments for follow-up joins with UrlClickEvents and EmailAttachmentInfo.
kql
EmailEvents
| where Timestamp > ago(3d)
| where UrlCount > 0 and AttachmentCount > 0
| project Timestamp, NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject, ThreatTypes, UrlCount, AttachmentCount
| order by Timestamp desc
Related KQL
Pivot from suspicious email to URL clicks
Find delivered inbound messages from a suspicious sender domain, join URL metadata, then pivot into user click activity.
let lookback = {lookback};
let senderDomain = "{sender_domain}";
let suspiciousMessages = EmailEvents
| where Timestamp > ago(lookback)
| where EmailDirection == "Inbound"
| where SenderFromDomain =~ senderDomain
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes;
suspiciousMessages
| join kind=leftouter (
EmailUrlInfo
| project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| join kind=leftouter (
UrlClickEvents
| where Timestamp > ago(lookback)
| project ClickTimestamp=Timestamp, NetworkMessageId, AccountUpn, Url, ActionType, IsClickedThrough, ThreatTypes
) on NetworkMessageId, Url
| order by Timestamp desc, ClickTimestamp desc
Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing investigation themes with tenant-specific placeholders and current MDO table names.
Summarize inbound email authentication failures
Parse EmailEvents authentication details to summarize SPF, DKIM, DMARC, and composite authentication outcomes by sender domain.
EmailEvents
| where Timestamp > ago({lookback})
| where EmailDirection == "Inbound"
| extend Auth = parse_json(AuthenticationDetails)
| extend SPF=tostring(Auth.SPF), DKIM=tostring(Auth.DKIM), DMARC=tostring(Auth.DMARC), CompAuth=tostring(Auth.CompAuth)
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 5) by SenderFromDomain, SPF, DKIM, DMARC, CompAuth, DeliveryAction
| order by Messages desc
Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing and Microsoft 365 compromise themes; converted to a generalized authentication summary.