table

EmailUrlInfo

EmailUrlInfo contains information about URLs found in emails and attachments processed by Microsoft Defender for Office 365.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproductMicrosoft Graph Security API
API accessapiLegacy Microsoft Defender XDR APIs
API accessapiEmailEvents
Related tabletableUrlClickEvents
Related tabletable

Schema

FieldTypeDescriptionCopy
TimestampdatetimeDate and time when the event was recorded.
NetworkMessageIdstringUnique identifier for the email, generated by Microsoft 365.
UrlstringFull URL in the email subject, body, or attachment.
UrlDomainstringDomain name or host name of the URL.
UrlLocationstringPart of the email where the URL is located.
UrlChainIdstringUnique identifier of the entire URL chain.
UrlChainPositionintPosition of the URL in the chain relative to the root URL.
ReportIdstringEvent identifier based on a repeating counter.

Related KQL

Pivot from suspicious email to URL clicks

Find delivered inbound messages from a suspicious sender domain, join URL metadata, then pivot into user click activity.

template
intermediatephishinguser-compromise
Run surface
Defender XDR Advanced Hunting, Sentinel Logs
Required tables
EmailEventsEmailUrlInfoUrlClickEvents
License context
Microsoft Defender for Office 365 Plan 2
kql
let lookback = {lookback};
let senderDomain = "{sender_domain}";
let suspiciousMessages = EmailEvents
| where Timestamp > ago(lookback)
| where EmailDirection == "Inbound"
| where SenderFromDomain =~ senderDomain
| project Timestamp, NetworkMessageId, SenderFromAddress, SenderFromDomain, RecipientEmailAddress, Subject, DeliveryAction, DeliveryLocation, ThreatTypes;
suspiciousMessages
| join kind=leftouter (
    EmailUrlInfo
    | project NetworkMessageId, Url, UrlDomain, UrlLocation
) on NetworkMessageId
| join kind=leftouter (
    UrlClickEvents
    | where Timestamp > ago(lookback)
    | project ClickTimestamp=Timestamp, NetworkMessageId, AccountUpn, Url, ActionType, IsClickedThrough, ThreatTypes
) on NetworkMessageId, Url
| order by Timestamp desc, ClickTimestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from phishing investigation themes with tenant-specific placeholders and current MDO table names.