Skip to content

Commit 5fafe47

Browse files
poliveriapoliveria
authored
Merge pull request #5797 from MicrosoftDocs/maccruz-campaigns
Maccruz campaigns
2 parents d1ce962 + 238c2da commit 5fafe47

File tree

5 files changed

+147
-2
lines changed

5 files changed

+147
-2
lines changed

‎defender-xdr/TOC.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -240,6 +240,8 @@
240240
href: advanced-hunting-behaviorentities-table.md
241241
- name: BehaviorInfo
242242
href: advanced-hunting-behaviorinfo-table.md
243+
- name: CampaignIno
244+
href: advanced-hunting-campaigninfo-table.md
243245
- name: CloudAppEvents
244246
href: advanced-hunting-cloudappevents-table.md
245247
- name: CloudAuditEvents
@@ -320,6 +322,8 @@
320322
href: advanced-hunting-exposuregraphedges-table.md
321323
- name: ExposureGraphNodes
322324
href: advanced-hunting-exposuregraphnodes-table.md
325+
- name: FileMaliciousContentInfo
326+
href: advanced-hunting-filemaliciouscontentinfo-table.md
323327
- name: GraphApiAuditEvents
324328
href: advanced-hunting-graphapiauditevents-table.md
325329
- name: IdentityAccountInfo

‎defender-xdr/advanced-hunting-campaigninfo-table.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: CampaignInfo table in the advanced hunting schema
3+
description: Learn about the CampaignInfo table of the advanced hunting schema
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: pauloliveria
10+
author: poliveria
11+
ms.localizationpriority: medium
12+
manager: orspodek
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
- Microsoft Sentinel in the Microsoft Defender portal
23+
ms.topic: reference
24+
ms.date: 12/01/2025
25+
---
26+
27+
# CampaignInfo (Preview)
28+
29+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
30+
31+
> [!IMPORTANT]
32+
> Some information relates to prereleased product which might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
33+
34+
35+
The `CampaignInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about email campaigns identified by Microsoft Defender for Office 365. Use this reference to construct queries that return information from this table.
36+
37+
This advanced hunting table is populated by records from Defender for Office 365. If your organization didn't deploy the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Office 365 in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
38+
39+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
40+
41+
42+
43+
| Column name | Data type | Description |
44+
|-------------|-----------|-------------|
45+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
46+
| `CampaignName` | `string` | Name of the email campaign |
47+
| `CampaignId` | `string` | Unique identifier for the campaign, generated by Microsoft Defender for Office 365 |
48+
| `CampaignType` | `string` | Category of the campaign, like Phish, Malware, Spam, and others |
49+
| `CampaignSubtype` | `string` | Contains more details about the campaign, like the brand being phished or related malware campaigns, if available |
50+
| `NetworkMessageId` | `string` | Unique identifier for the email, generated by Microsoft Defender for Office 365 |
51+
| `RecipientEmailAddress` | `string` | Email address of the recipient, or email address of the recipient after distribution list expansion |
52+
| `ReportId` | `string` | Unique identifier for the event |
53+
54+
55+
## Read more
56+
57+
- [Advanced hunting overview](advanced-hunting-overview.md)
58+
- [Learn the query language](advanced-hunting-query-language.md)
59+
- [Use shared queries](advanced-hunting-shared-queries.md)
60+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
61+
- [Understand the schema](advanced-hunting-schema-tables.md)
62+
- [Apply query best practices](advanced-hunting-best-practices.md)
63+

‎defender-xdr/advanced-hunting-filemaliciouscontentinfo-table.md‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
---
2+
title: FileMaliciousContentInfo table in the advanced hunting schema
3+
description: Learn about the FileMaliciousContentInfo table of the advanced hunting schema
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: pauloliveria
10+
author: poliveria
11+
ms.localizationpriority: medium
12+
manager: orspodek
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
- Microsoft Sentinel in the Microsoft Defender portal
23+
ms.topic: reference
24+
ms.date: 12/01/2025
25+
---
26+
27+
# FileMaliciousContentInfo (Preview)
28+
29+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
30+
31+
> [!IMPORTANT]
32+
> Some information relates to prereleased product which might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
33+
34+
The `FileMaliciousContentInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about files that were identified as malicious by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams. Use this reference to construct queries that return information from this table.
35+
36+
> [!TIP]
37+
> For detailed information about the events types (`ActionType` values) supported by a table, use the built-in schema reference available in Microsoft Defender XDR.
38+
39+
This advanced hunting table is populated by records from Defender for Office 365. If your organization didn't deploy the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Office 365 in Defender XDR, read [Deploy supported services](deploy-supported-services.md).
40+
41+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
42+
43+
44+
45+
| Column name | Data type | Description |
46+
|-------------|-----------|-------------|
47+
| `Timestamp` | `datetime` | Date and time when the event was generated |
48+
| `Workload`| `string` | Information about the workload from which the URL originated from |
49+
| `FileName`| `string` | Name of the file that the recorded action was applied to |
50+
| `FolderPath`| `string` | Path of the folder containing the file that the recorded action was applied to |
51+
| `FileSize`| `long` | Size of the file in bytes |
52+
| `SHA256`| `string` | SHA-256 of the file that the recorded action was applied to |
53+
| `FileOwnerDisplayName`| `string` | Account recorded as owner of the file |
54+
| `FileOwnerUpn`| `string` | Account recorded as owner of the file|
55+
| `DocumentId`| `string` | Unique identifier of the file |
56+
| `ThreatTypes`| `dynamic` | Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats |
57+
| `ThreatNames`| `string` | Detection name for malware or other threats found|
58+
| `DetectionMethods`| `string` | Methods used to detect malware, phishing, or other threats found in the email |
59+
| `LastModifyingAccountUpn`| `string` | Account that last modified this file |
60+
| `LastModifiedTime`| `datetime` |Date and time the item or related metadata was last modified|
61+
| `FileCreationTime `| `datetime` | Timestamp of the file creation|
62+
| `ReportId`| `string` | Unique identifier for the event |
63+
64+
65+
66+
## Read more
67+
68+
- [Advanced hunting overview](advanced-hunting-overview.md)
69+
- [Learn the query language](advanced-hunting-query-language.md)
70+
- [Use shared queries](advanced-hunting-shared-queries.md)
71+
- [Hunt across devices, emails, apps, and identities](advanced-hunting-query-emails-devices.md)
72+
- [Understand the schema](advanced-hunting-schema-tables.md)
73+
- [Apply query best practices](advanced-hunting-best-practices.md)

‎defender-xdr/advanced-hunting-schema-tables.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,7 @@ The following reference lists all the tables in the schema. Each table name link
6161
| **[AlertInfo](advanced-hunting-alertinfo-table.md)** | Alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Identity, including severity information and threat categorization |
6262
| **[BehaviorEntities](advanced-hunting-behaviorentities-table.md)** (Preview) | Behavior data types in Microsoft Defender for Cloud Apps (not available for GCC) |
6363
| **[BehaviorInfo](advanced-hunting-behaviorinfo-table.md)** (Preview) | Alerts from Microsoft Defender for Cloud Apps (not available for GCC) |
64+
| **[CampaignInfo](advanced-hunting-campaigninfo-table.md)** (Preview) | Email campaigns identified by Microsoft Defender for Office 365 |
6465
| **[CloudAppEvents](advanced-hunting-cloudappevents-table.md)** | Events involving accounts and objects in Office 365 and other cloud apps and services |
6566
| **[CloudAuditEvents](advanced-hunting-cloudauditevents-table.md)** (Preview)| Cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud |
6667
| **[CloudProcessEvents](advanced-hunting-cloudprocessevents-table.md)** (Preview)| Cloud process events for various cloud platforms protected by the organization's Microsoft Defender for Containers |
@@ -101,6 +102,7 @@ The following reference lists all the tables in the schema. Each table name link
101102
| **[EntraIdSpnSignInEvents](advanced-hunting-entraidspnsigninevents-table.md)** (Preview)| Microsoft Entra service principal and managed identity sign-ins |
102103
| **[ExposureGraphEdges](advanced-hunting-exposuregraphedges-table.md)** | Microsoft Security Exposure Management exposure graph edge information provides visibility into relationships between entities and assets in the graph |
103104
| **[ExposureGraphNodes](advanced-hunting-exposuregraphnodes-table.md)** | Microsoft Security Exposure Management exposure graph node information, about organizational entities and their properties |
105+
| **[FileMaliciousContentInfo](advanced-hunting-emailurlinfo-table.md)** (Preview) | Files that were identified as malicious by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams |
104106
| **[GraphApiAuditEvents](advanced-hunting-graphapiauditevents-table.md)** (Preview) | Microsoft Entra ID API requests made to Microsoft Graph API for resources in the tenant |
105107
| **[IdentityAccountInfo](advanced-hunting-identityaccountinfo-table.md)** (Preview) | Account information from various sources, including Microsoft Entra ID. This table also includes information and link to the identity that owns the account. |
106108
| **[IdentityDirectoryEvents](advanced-hunting-identitydirectoryevents-table.md)** | Events involving an on-premises domain controller running Active Directory (AD). This table covers a range of identity-related events and system events on the domain controller. |

‎defender-xdr/whats-new.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.service: defender-xdr
66
ms.author: guywild
77
author: guywi-ms
88
ms.localizationpriority: medium
9-
ms.date: 11/18/2025
9+
ms.date: 12/01/2025
1010
manager: deniseb
1111
audience: ITPro
1212
ms.collection:
@@ -33,8 +33,11 @@ For more information on what's new with other Microsoft Defender security produc
3333
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
3434

3535
## December 2025
36+
- (Preview) The following advanced hunting schema tables are now available for preview:
37+
- The [`CampaignInfo`](advanced-hunting-campaigninfo-table.md) table contains contains information about email campaigns identified by Microsoft Defender for Office 365
38+
- The [`FileMaliciousContentInfo`](advanced-hunting-filemaliciouscontentinfo-table.md) table contains information about files that were identified as malicious by Microsoft Defender for Office 365 in SharePoint Online, OneDrive, and Microsoft Teams
3639
- (GA) The [hunting graph](advanced-hunting-graph.md) in advanced hunting is now generally available. It also now has two new predefined threat scenarios that you can use to render your hunts as interactive graphs.
37-
- Advanced hunting now supports custom functions that use tabular parameters. With tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. [Learn more](advanced-hunting-custom-functions.md#create-custom-functions-with-tabular-parameters)
40+
- (GA) Advanced hunting now supports custom functions that use tabular parameters. With tabular parameters, you can pass entire tables as inputs. This approach lets you build more modular, reusable, and expressive logic across your hunting queries. [Learn more](advanced-hunting-custom-functions.md#create-custom-functions-with-tabular-parameters)
3841

3942
## November 2025
4043
- Microsoft Sentinel customers using the Defender portal, or the Azure portal with the Microsoft Sentinel Defender XDR data connector, now also benefit from Microsoft Threat Intelligence alerts that highlight activity from nation-state actors, major ransomware campaigns, and fraudulent operations. To view these alert types, you must have the **Security Administrator** or **Global Administrator** role. The **Service Source**, **Detection Source**, and **Product Name** values for these alerts are listed as *Microsoft Threat Intelligence*. For more information, see [Incidents and alerts in the Microsoft Defender portal](incidents-overview.md).

0 commit comments

Comments
 (0)