Skip to content

Commit b99185c

Browse files
Update advanced-hunting-emailattachmentinfo-table.md
Describing "FileType" as "File extension type" is misleading and can make people think of the file's extension (e.g. `.exe`) while the field is actually a file content type (e.g. `txt;text` or `email;mime` or `png`).
1 parent 2408ee2 commit b99185c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

defender-xdr/advanced-hunting-emailattachmentinfo-table.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ For information on other tables in the advanced hunting schema, [see the advance
5151
| `RecipientEmailAddress` | `string` | Email address of the recipient, or email address of the recipient after distribution list expansion |
5252
| `RecipientObjectId` | `string` | Unique identifier for the email recipient in Microsoft Entra ID |
5353
| `FileName` | `string` | Name of the file that the recorded action was applied to |
54-
| `FileType` | `string` | File extension type |
54+
| `FileType` | `string` | File content type |
5555
| `SHA256` | `string` | SHA-256 of the file that the recorded action was applied to. This field is usually not populated — use the SHA1 column when available. |
5656
| `FileSize` | `long` | Size of the file in bytes |
5757
| `ThreatTypes` | `string` | Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats |

0 commit comments

Comments
 (0)