diff --git a/defender-xdr/advanced-hunting-emailattachmentinfo-table.md b/defender-xdr/advanced-hunting-emailattachmentinfo-table.md index 7e099a6b35..ffd6452fe9 100644 --- a/defender-xdr/advanced-hunting-emailattachmentinfo-table.md +++ b/defender-xdr/advanced-hunting-emailattachmentinfo-table.md @@ -51,7 +51,7 @@ For information on other tables in the advanced hunting schema, [see the advance | `RecipientEmailAddress` | `string` | Email address of the recipient, or email address of the recipient after distribution list expansion | | `RecipientObjectId` | `string` | Unique identifier for the email recipient in Microsoft Entra ID | | `FileName` | `string` | Name of the file that the recorded action was applied to | -| `FileType` | `string` | File extension type | +| `FileType` | `string` | File content type | | `SHA256` | `string` | SHA-256 of the file that the recorded action was applied to. This field is usually not populated — use the SHA1 column when available. | | `FileSize` | `long` | Size of the file in bytes | | `ThreatTypes` | `string` | Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats |