Skip to content

Commit eb58520

Browse files
padmagit77padmagit77
authored
Merge pull request #3374 from MicrosoftDocs/maccruz-teamstables
Teams tables
2 parents 6597778 + c0711e5 commit eb58520

5 files changed

+203
-0
lines changed

‎defender-xdr/TOC.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,6 +306,12 @@
306306
href: advanced-hunting-identitylogonevents-table.md
307307
- name: IdentityQueryEvents
308308
href: advanced-hunting-identityqueryevents-table.md
309+
- name: MessageEvents
310+
href: advanced-hunting-messageevents-table.md
311+
- name: MessagePostDeliveryEvents
312+
href: advanced-hunting-messagepostdeliveryevents-table.md
313+
- name: MessageUrlInfo
314+
href: advanced-hunting-messageurlinfo-table.md
309315
- name: OAuthAppInfo
310316
href: advanced-hunting-oauthappinfo-table.md
311317
- name: UrlClickEvents

‎defender-xdr/advanced-hunting-messageevents-table.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: MessageEvents table in the advanced hunting schema
3+
description: Learn about the MessageEvents table in the advanced hunting schema which contains details about messages sent and received within your organization at the time of delivery
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
ms.topic: reference
23+
ms.date: 03/18/2025
24+
---
25+
26+
# MessageEvents (Preview)
27+
28+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `MessageEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains details about messages sent and received within your organization at the time of delivery. Use this reference to construct queries that return information from this table.
34+
35+
36+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
37+
38+
| Column name | Data type | Description |
39+
|-------------|-----------|-------------|
40+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
41+
| `LastEditedTime` | `string` | Date and time when the message was last edited |
42+
| `TeamsMessageId` | `string` | Unique identifier for the message, as generated by Microsoft 365 |
43+
| `SenderEmailAddress` | `string` | Email address of the sender |
44+
| `SenderDisplayName` | `string` | Name of the sender displayed in the address book, typically a combination of a first name, a middle initial, and a last name or surname |
45+
| `SenderObjectId` | `string` | Unique identifier for the sender’s account |
46+
| `SenderType` | `string` | Type of user that sent the message, for example, User, Group, Anonymous |
47+
| `RecipientDetails` | `dynamic` | Array of recipient data (RecipientSmtpAddress, RecipientDisplayName, RecipientType, RecipientObjectId) |
48+
| `IsOwnedThread` | `boolean` | Boolean value indicating whether the message is owned by your organization or not (only the messages owned by your organization can be remediated)|
49+
| `MessageId` | `string` | Identifier for the message (non-unique)|
50+
| `ParentMessageId` | `string` | Identifier for the message that the current message was a reply to, otherwise this is the same as the MessageId|
51+
| `GroupId` | `string` | Identifier for the team or group that the message was sent to|
52+
| `GroupName` | `string` | Name of the team or group that the message was sent to|
53+
| `ThreadId` | `string` | Identifier of the channel or chat thread that the message is part of |
54+
| `ThreadSubtype` | `string` | Indicates the channel type, possible values: None, PrivateChannel|
55+
| `IsExternalThread` | `boolean` | Indicates if there are external recipients in the thread (1) or none (0) |
56+
| `MessageFormatType` | `string` |Type of message format; possible values: RichText, Text|
57+
| `MessageFormatSubtype` | `string` |Subtype of message format, for example, HTML|
58+
| `MessageVersion` | `string` |Version number of the message|
59+
| `MessageSubject` | `string` |Subject of the message, if it exists|
60+
| `ThreatTypes` | `string` |Verdict from the filtering stack on whether the message contains malware, phishing, or other threats|
61+
| `DetectionMethods` | `dynamic` |Methods used to detect malware, phishing, or other threats found in the message|
62+
| `ConfidenceLevel` | `dynamic` |List of confidence levels for each threat type identified|
63+
| `DeliveryAction` | `string` |Delivery action of the message: Delivered, Blocked|
64+
| `DeliveryLocation` | `string` |Location of the message at the time of delivery|
65+
| `ReportId` | `string` |Unique identifier for the event|
66+
67+
68+
69+
## Related topics
70+
- [Advanced hunting overview](advanced-hunting-overview.md)
71+
- [Learn the query language](advanced-hunting-query-language.md)
72+
- [Understand the schema](advanced-hunting-schema-tables.md)
73+
- [Apply query best practices](advanced-hunting-best-practices.md)
74+
75+
76+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-messagepostdeliveryevents-table.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: MessagePostDeliveryEvents table in the advanced hunting schema
3+
description: Learn about the MessagePostDeliveryEvents table in the advanced hunting schema which contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
ms.topic: reference
23+
ms.date: 03/18/2025
24+
---
25+
26+
# MessagePostDeliveryEvents (Preview)
27+
28+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `MessagePostDeliveryEvents` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization.
34+
35+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
40+
| `TeamsMessageId` | `string` | Unique identifier for the message, as generated by Microsoft 365 |
41+
| `Action` | `string` | Action taken on the message: Blocked, Moved to quarantine |
42+
| `ActionType` | `string` | Type of activity that triggered the event: Manual remediation, Phish ZAP, Malware ZAP |
43+
| `ActionTrigger` | `string` | Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery |
44+
| `ActionResult` | `string` | Result of the action |
45+
| `SenderEmailAddress` | `string` | Email address of the sender |
46+
| `RecipientDetails` | `dynamic` | Array of recipient data (RecipientSmtpAddress, RecipientDisplayName, RecipientType, RecipientObjectId) |
47+
| `ThreatTypes` | `string` |Verdict from the filtering stack on whether the message contains malware, phishing, or other threats|
48+
| `ConfidenceLevel` | `dynamic` |List of confidence levels for each threat type identified|
49+
| `DetectionMethods` | `string` |Methods used to detect malware, phishing, or other threats found in the message|
50+
| `LatestDeliveryLocation` | `string` |Last known location of the message |
51+
| `ReportId` | `string` |Unique identifier for the event|
52+
| `IsExternalThread` | `boolean` |Indicates if there are external recipients in the thread (1) or none (0)|
53+
54+
55+
56+
## Related topics
57+
- [Advanced hunting overview](advanced-hunting-overview.md)
58+
- [Learn the query language](advanced-hunting-query-language.md)
59+
- [Understand the schema](advanced-hunting-schema-tables.md)
60+
- [Apply query best practices](advanced-hunting-best-practices.md)
61+
62+
63+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-messageurlinfo-table.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
title: MessageUrlInfo table in the advanced hunting schema
3+
description: Learn about the MessageUrlInfo table in the advanced hunting schema which contains information about URLs sent through Microsoft Teams messages in your organization.
4+
search.appverid: met150
5+
ms.service: defender-xdr
6+
ms.subservice: adv-hunting
7+
f1.keywords:
8+
- NOCSH
9+
ms.author: maccruz
10+
author: schmurky
11+
ms.localizationpriority: medium
12+
manager: dansimp
13+
audience: ITPro
14+
ms.collection:
15+
- m365-security
16+
- tier3
17+
ms.custom:
18+
- cx-ti
19+
- cx-ah
20+
appliesto:
21+
- Microsoft Defender XDR
22+
ms.topic: reference
23+
ms.date: 03/18/2025
24+
---
25+
26+
# MessageUrlInfo (Preview)
27+
28+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
29+
30+
> [!IMPORTANT]
31+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
32+
33+
The `MessageUrlInfo` table in the [advanced hunting](advanced-hunting-overview.md) schema contains information about URLs sent through Microsoft Teams messages in your organization.
34+
35+
For information on other tables in the advanced hunting schema, [see the advanced hunting reference](advanced-hunting-schema-tables.md).
36+
37+
| Column name | Data type | Description |
38+
|-------------|-----------|-------------|
39+
| `Timestamp` | `datetime` | Date and time when the event was recorded |
40+
| `TeamsMessageId` | `string` | Unique identifier for the message, as generated by Microsoft 365 |
41+
| `Url` | `string` |URL from message|
42+
| `UrlDomain` | `string` |Domain name or host name of the URL|
43+
| `ThreatTypes` | `string` |Verdict from the filtering stack on whether the message contains malware, phishing, or other threats|
44+
| `ReportId` | `string` |Unique identifier for the event|
45+
46+
47+
48+
## Related topics
49+
- [Advanced hunting overview](advanced-hunting-overview.md)
50+
- [Learn the query language](advanced-hunting-query-language.md)
51+
- [Understand the schema](advanced-hunting-schema-tables.md)
52+
- [Apply query best practices](advanced-hunting-best-practices.md)
53+
54+
55+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

‎defender-xdr/advanced-hunting-schema-tables.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,9 @@ The following reference lists all the tables in the schema. Each table name link
100100
| **[IdentityInfo](advanced-hunting-identityinfo-table.md)** | Account information from various sources, including Microsoft Entra ID |
101101
| **[IdentityLogonEvents](advanced-hunting-identitylogonevents-table.md)** | Authentication events on Active Directory and Microsoft online services |
102102
| **[IdentityQueryEvents](advanced-hunting-identityqueryevents-table.md)** | Queries for Active Directory objects, such as users, groups, devices, and domains |
103+
| **[MessageEvents](advanced-hunting-messageevents-table.md)** (Preview) | Messages sent and received within your organization at the time of delivery |
104+
| **[MessagePostDeliveryEvents](advanced-hunting-messagepostdeliveryevents-table.md)** (Preview) | Security events that occurred after the delivery of a Microsoft Teams message in your organization |
105+
| **[MessageUrlInfo](advanced-hunting-messageurlinfo-table.md)** (Preview) | URLs sent through Microsoft Teams messages in your organization |
103106
| **[OAuthAppInfo](advanced-hunting-oauthappinfo-table.md)** (Preview) | Microsoft 365-connected OAuth applications registered with Microsoft Entra ID and available in the Defender for Cloud Apps app governance capability |
104107
| **[UrlClickEvents](advanced-hunting-urlclickevents-table.md)** | Safe Links clicks from email messages, Teams, and Office 365 apps |
105108

0 commit comments

Comments
 (0)