Skip to content

Commit 829386b

Browse files
schmurkyschmurky
committed
New Teams tables
1 parent 6acb581 commit 829386b

6 files changed

+210
-0
lines changed

‎defender-xdr/TOC.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,12 @@
306306
href: advanced-hunting-identitylogonevents-table.md
307307
- name: IdentityQueryEvents
308308
href: advanced-hunting-identityqueryevents-table.md
309+
- name: MessageEvents
310+
href: advanced-hunting-messageevents-table.md
311+
- name: MessagePostDeliveryEvents
312+
href: advanced-hunting-messagepostdeliveryevents-table.md
313+
- name: MessageUrlInfo
314+
href: advanced-hunting-messageurlinfo-table.md
309315
- name: UrlClickEvents
310316
href: advanced-hunting-urlclickevents-table.md
311317
- name: Custom detections

‎defender-xdr/advanced-hunting-messageevents-table.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: MessageEvents table in the advanced hunting schema
3+
description: Learn about the MessageEvents table in the advanced hunting schema which contains details about messages sent and received within your organization at the time of delivery
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
ms.topic: reference
23+
ms.date: 03/18/2025
24+
---
25+
26+
# MessageEvents (Preview)
27+
28+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `MessageEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains details about messages sent and received within your organization at the time of delivery. Use this reference to construct queries that return information from this table.
34+
35+
36+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
37+
38+
| Column name | Data type | Description |
39+
|-------------|-----------|-------------|
40+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
41+
| `LastEditedTime` | `string` | Date and time when the message was last edited |
42+
| `TeamsMessageId` | `string` | Unique identifier for the message, as generated by Microsoft 365 |
43+
| `SenderEmailAddress` | `string` | Email address of the sender |
44+
| `SenderDisplayName` | `string` | Name of the sender displayed in the address book, typically a combination of a first name, a middle initial, and a last name or surname |
45+
| `SenderObjectId` | `string` | Unique identifier for the sender’s account |
46+
| `SenderType` | `string` | Type of user that sent the message, for example, User, Group, Anonymous |
47+
| `RecipientDetails` | `dynamic` | Array of recipient data (RecipientEmailAddress, RecipientDisplayName, RecipientType, RecipientObjectId) |
48+
| `IsOwnedThread` | `boolean` | Boolean value indicating whether the message is owned by your organization or not (only the messages owned by your organization can be remediated)|
49+
| `MessageId` | `string` | Identifier for the message (non-unique)|
50+
| `ParentMessageId` | `string` | Identifier for the message that the current message was a reply to, otherwise this is the same as the MessageId|
51+
| `GroupId` | `string` | Identifier for the team or group that the message was sent to|
52+
| `GroupName` | `string` | Name of the team or group that the message was sent to|
53+
| `ThreadId` | `string` | Identifier of the channel or chat thread that the message is part of |
54+
| `ThreadSubtype` | `string` | Indicates the channel type, possible values: None, PrivateChannel|
55+
| `IsExternalThread` | `boolean` | Indicates if there are external recipients in the thread (1) or none (0) |
56+
| `MessageFormatType` | `string` |Type of message format; possible values: RichText, Text|
57+
| `MessageFormatSubtype` | `string` |Subtype of message format, for example, HTML|
58+
| `MessageVersion` | `string` |Version number of the message|
59+
| `MessageSubject` | `string` |Subject of the message, if it exists|
60+
| `ThreatTypes` | `string` |Verdict from the filtering stack on whether the message contains malware, phishing, or other threats|
61+
| `DetectionMethods` | `dynamic` |Methods used to detect malware, phishing, or other threats found in the message|
62+
| `ConfidenceLevel` | `dynamic` |List of confidence levels for each threat type identified|
63+
| `DeliveryAction` | `string` |Delivery action of the message: Delivered, Blocked|
64+
| `DeliveryLocation` | `string` |Location of the message at the time of delivery|
65+
| `ReportId` | `string` |Unique identifier for the event|
66+
67+
68+
69+
## Related topics
70+
- [Advanced hunting overview](advanced-hunting-overview.md)
71+
- [Learn the query language](advanced-hunting-query-language.md)
72+
- [Understand the schema](advanced-hunting-schema-tables.md)
73+
- [Apply query best practices](advanced-hunting-best-practices.md)
74+
75+
76+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-messagepostdeliveryevents-table.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: MessagePostDeliveryEvents table in the advanced hunting schema
3+
description: Learn about the MessagePostDeliveryEvents table in the advanced hunting schema which contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
ms.topic: reference
23+
ms.date: 03/18/2025
24+
---
25+
26+
# MessageEvents (Preview)
27+
28+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `MessageEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization.
34+
35+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
40+
| `TeamsMessageId` | `string` | Unique identifier for the message, as generated by Microsoft 365 |
41+
| `Action` | `string` | Action taken on the message: Blocked, Moved to quarantine |
42+
| `ActionType` | `string` | Type of activity that triggered the event: Manual remediation, Phish ZAP, Malware ZAP |
43+
| `ActionTrigger` | `string` | Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery |
44+
| `ActionResult` | `string` | Result of the action |
45+
| `SenderEmailAddress` | `string` | Email address of the sender |
46+
| `RecipientDetails` | `dynamic` | Array of recipient data (RecipientEmailAddress, RecipientDisplayName, RecipientType, RecipientObjectId) |
47+
| `ThreatTypes` | `string` |Verdict from the filtering stack on whether the message contains malware, phishing, or other threats|
48+
| `ConfidenceLevel` | `dynamic` |List of confidence levels for each threat type identified|
49+
| `DetectionMethods` | `string` |Methods used to detect malware, phishing, or other threats found in the message|
50+
| `LatestDeliveryLocation` | `string` |Last known location of the message |
51+
| `ReportId` | `string` |Unique identifier for the event|
52+
| `IsExternalThread` | `boolean` |Indicates if there are external recipients in the thread (1) or none (0)|
53+
54+
55+
56+
## Related topics
57+
- [Advanced hunting overview](advanced-hunting-overview.md)
58+
- [Learn the query language](advanced-hunting-query-language.md)
59+
- [Understand the schema](advanced-hunting-schema-tables.md)
60+
- [Apply query best practices](advanced-hunting-best-practices.md)
61+
62+
63+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-messageurlinfo-table.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: MessageUrlInfo table in the advanced hunting schema
3+
description: Learn about the MessageUrlInfo table in the advanced hunting schema which contains information about URLs sent through Microsoft Teams messages in your organization.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
ms.topic: reference
23+
ms.date: 03/18/2025
24+
---
25+
26+
# MessageEvents (Preview)
27+
28+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `MessageUrlInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about URLs sent through Microsoft Teams messages in your organization.
34+
35+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
40+
| `TeamsMessageId` | `string` | Unique identifier for the message, as generated by Microsoft 365 |
41+
| `Url` | `string` |URL from message|
42+
| `UrlDomain` | `string` |Domain name or host name of the URL|
43+
| `ThreatTypes` | `string` |Verdict from the filtering stack on whether the message contains malware, phishing, or other threats|
44+
| `ReportId` | `string` |Unique identifier for the event|
45+
46+
47+
48+
## Related topics
49+
- [Advanced hunting overview](advanced-hunting-overview.md)
50+
- [Learn the query language](advanced-hunting-query-language.md)
51+
- [Understand the schema](advanced-hunting-schema-tables.md)
52+
- [Apply query best practices](advanced-hunting-best-practices.md)
53+
54+
55+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-schema-tables.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,9 @@ The following reference lists all the tables in the schema. Each table name link
100100
| **[IdentityInfo](advanced-hunting-identityinfo-table.md)** | Account information from various sources, including Microsoft Entra ID |
101101
| **[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)** | Authentication events on Active Directory and Microsoft online services |
102102
| **[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)** | Queries for Active Directory objects, such as users, groups, devices, and domains |
103+
| **[MessageEvents](advanced-hunting-messageevents-table.md)** (Preview) | Messages sent and received within your organization at the time of delivery |
104+
| **[MessagePostDeliveryEvents](advanced-hunting-messagepostdeliveryevents-table.md)** (Preview) | Security events that occurred after the delivery of a Microsoft Teams message in your organization |
105+
| **[MessageUrlInfo](advanced-hunting-messageurlinfo-table.md)** (Preview) | URLs sent through Microsoft Teams messages in your organization |
103106
| **[UrlClickEvents](advanced-hunting-urlclickevents-table.md)** | Safe Links clicks from email messages, Teams, and Office 365 apps |
104107

105108
## Related topics

‎defender-xdr/whats-new.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,13 @@ For more information on what's new with other Microsoft Defender security produc
3232

3333
You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
3434

35+
36+
## April 2025
37+
- (Preview) The following advanced hunting schema tables are now available for preview to help you look through Microsoft Teams events and related information:
38+
- The [MessageEvents](advanced-hunting-messageevents-table.md) table contains details about messages sent and received within your organization at the time of delivery.
39+
- The [MessagePostDeliveryEvents](advanced-hunting-messagepostdeliveryevents-table.md) table contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization.
40+
- The [MessageUrlInfo](advanced-hunting-messageurlinfo-table.md) table contains information about URLs sent through Microsoft Teams messages in your organization.
41+
3542
## February 2025
3643

3744
- (Preview) IP addresses can now be excluded from automated responses in attack disruption. This feature allows you to exclude specific IPs from automated containment actions triggered by attack disruption. For more information, see [Exclude assets from automated responses in automatic attack disruption](automatic-attack-disruption-exclusions.md).

0 commit comments

Comments
 (0)