table

EmailEvents

EmailEvents contains Microsoft 365 email delivery and blocking events processed by Microsoft Defender for Office 365.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproduct Microsoft Graph Security API
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi EmailAttachmentInfo
Related tabletable EmailUrlInfo
Related tabletable EmailPostDeliveryEvents
Related tabletable CampaignInfo
Related tabletable

Schema

Field	Type	Description
`Timestamp`	datetime	Date and time when the event was recorded.
`NetworkMessageId`	string	Unique identifier for the email, generated by Microsoft 365.
`InternetMessageId`	string	Public-facing identifier set by the sending email system.
`SenderMailFromAddress`	string	Sender address from the MAIL FROM header, also known as the envelope sender.
`SenderFromAddress`	string	Sender email address in the visible From header.
`SenderDisplayName`	string	Display name shown for the sender.
`SenderObjectId`	string	Microsoft Entra ID object ID for the sender account.
`SenderMailFromDomain`	string	Sender domain from the MAIL FROM header.
`SenderFromDomain`	string	Sender domain from the visible From header.
`SenderIPv4`	string	IPv4 address of the last detected mail server that relayed the message.
`SenderIPv6`	string	IPv6 address of the last detected mail server that relayed the message.
`RecipientEmailAddress`	string	Email address of the recipient.
`RecipientObjectId`	string	Microsoft Entra ID object ID for the recipient account.
`Subject`	string	Subject of the email.
`EmailClusterId`	long	Identifier for a group of similar emails clustered through content analysis.
`EmailDirection`	string	Direction of the message relative to the organization, such as inbound, outbound, or intra-org.
`DeliveryAction`	string	Delivery action of the email, such as Delivered, Junked, Blocked, or Replaced.
`DeliveryLocation`	string	Location where the email was delivered.
`ThreatTypes`	string	Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats.
`ThreatNames`	string	Detection name for malware or other threats found.
`DetectionMethods`	string	Methods used to detect malware, phishing, or other threats.
`ConfidenceLevel`	string	Spam or phishing confidence level assigned by filtering.
`BulkComplaintLevel`	int	Bulk complaint level assigned to email from bulk senders.
`EmailAction`	string	Final action applied to the message based on verdicts, policies, and user actions.
`EmailActionPolicy`	string	Policy category that determined the final email action.
`EmailActionPolicyGuid`	string	Unique identifier for the policy that determined the final action.
`AuthenticationDetails`	string	Authentication verdicts such as DMARC, DKIM, SPF, or composite authentication.
`AttachmentCount`	int	Number of attachments in the email.
`UrlCount`	int	Number of embedded URLs in the email.
`EmailLanguage`	string	Detected language of the email content.
`Connectors`	string	Custom mail flow routing instructions or connectors that affected the message.
`OrgLevelAction`	string	Action taken because of an organization-level policy match.
`OrgLevelPolicy`	string	Organization-level policy that triggered the action.
`UserLevelAction`	string	Action taken because of a user mailbox policy match.
`UserLevelPolicy`	string	User mailbox policy that triggered the action.
`ReportId`	string	Event identifier based on a repeating counter.
`AdditionalFields`	string	Additional event or entity details.
`LatestDeliveryLocation`	string	Last known location of the email; not available in the Streaming API.
`LatestDeliveryAction`	string	Last known delivery action attempted by the service or by admin remediation; not available in the Streaming API.
`DistributionList`	string	Top-level distribution list to which the email was sent, when applicable.
`ExchangeTransportRule`	string	Mail flow rule that acted on the message while it was in transit.
`ForwardingInformation`	string	JSON-formatted forwarding details, including forwarding user and forwarding type.
`Context`	string	Protection context in which the detection ran.
`To`	string	Addresses listed in the To header.
`Cc`	string	Addresses listed in the Cc header.
`ThreatClassification`	string	Threat classification assigned to the email.
`RecipientDomain`	string	Domain portion of the recipient address.
`EmailSize`	long	Size of the email message in bytes.
`IsFirstContact`	int	Indicates whether this was the first contact between the sender and recipient.

Sample KQL

Inbound phishing delivery by sender domain

Summarize inbound messages with phishing verdicts and where they landed.

kql

EmailEvents
| where Timestamp > ago(7d)
| where EmailDirection == "Inbound"
| where ThreatTypes has "Phish" or ThreatClassification has "Phish"
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress) by SenderFromDomain, DeliveryAction, DeliveryLocation
| order by Messages desc

Messages with URL and attachment exposure

Identify messages that combine embedded links and attachments for follow-up joins with UrlClickEvents and EmailAttachmentInfo.

kql

EmailEvents
| where Timestamp > ago(3d)
| where UrlCount > 0 and AttachmentCount > 0
| project Timestamp, NetworkMessageId, SenderFromAddress, RecipientEmailAddress, Subject, ThreatTypes, UrlCount, AttachmentCount
| order by Timestamp desc