table

FileMaliciousContentInfo

FileMaliciousContentInfo contains preview information about files processed by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams.

tablesCurrent

Relationships

Microsoft Defender for Office 365
Source productproduct Microsoft Graph Security API
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi EmailAttachmentInfo
Related tabletable

Schema

Field	Type	Description	Copy
`Timestamp`	datetime	Date and time when the event was generated.
`Workload`	string	Workload from which the file signal originated.
`FileName`	string	Name of the file that the recorded action was applied to.
`FolderPath`	string	Path of the folder containing the file.
`FileSize`	long	Size of the file in bytes.
`SHA256`	string	SHA-256 hash of the file.
`FileOwnerDisplayName`	string	Display name of the account recorded as owner of the file.
`FileOwnerUpn`	string	Account recorded as owner of the file.
`DocumentId`	string	Unique identifier of the file.
`ThreatTypes`	dynamic	Threat verdicts associated with the file.
`ThreatNames`	string	Detection name for malware or other threats.
`DetectionMethods`	string	Methods used to detect malware, phishing, or other threats in the file.
`LastModifyingAccountUpn`	string	Account that last modified the file.
`LastModifiedTime`	datetime	Date and time the file or related metadata was last modified.
`FileCreationTime`	datetime	Timestamp of file creation.
`ReportId`	string	Unique identifier for the event.