You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describing "FileType" as "File extension type" is misleading and can make people think of the file's extension (e.g. `.exe`) while the field is actually a file content type (e.g. `txt;text` or `email;mime` or `png`).
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-emailattachmentinfo-table.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -51,7 +51,7 @@ For information on other tables in the advanced hunting schema, [see the advance
51
51
|`RecipientEmailAddress`|`string`| Email address of the recipient, or email address of the recipient after distribution list expansion |
52
52
|`RecipientObjectId`|`string`| Unique identifier for the email recipient in Microsoft Entra ID |
53
53
|`FileName`|`string`| Name of the file that the recorded action was applied to |
54
-
|`FileType`|`string`| File extension type |
54
+
|`FileType`|`string`| File content type |
55
55
|`SHA256`|`string`| SHA-256 of the file that the recorded action was applied to. This field is usually not populated — use the SHA1 column when available. |
56
56
|`FileSize`|`long`| Size of the file in bytes |
57
57
|`ThreatTypes`|`string`| Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats |
0 commit comments