From b99185c167d429a4cc35c4ac6a3d5b9d885f1be7 Mon Sep 17 00:00:00 2001 From: David Date: Thu, 3 Jul 2025 16:24:19 +0200 Subject: [PATCH] Update advanced-hunting-emailattachmentinfo-table.md Describing "FileType" as "File extension type" is misleading and can make people think of the file's extension (e.g. `.exe`) while the field is actually a file content type (e.g. `txt;text` or `email;mime` or `png`). --- defender-xdr/advanced-hunting-emailattachmentinfo-table.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/defender-xdr/advanced-hunting-emailattachmentinfo-table.md b/defender-xdr/advanced-hunting-emailattachmentinfo-table.md index 7e099a6b35..ffd6452fe9 100644 --- a/defender-xdr/advanced-hunting-emailattachmentinfo-table.md +++ b/defender-xdr/advanced-hunting-emailattachmentinfo-table.md @@ -51,7 +51,7 @@ For information on other tables in the advanced hunting schema, [see the advance | `RecipientEmailAddress` | `string` | Email address of the recipient, or email address of the recipient after distribution list expansion | | `RecipientObjectId` | `string` | Unique identifier for the email recipient in Microsoft Entra ID | | `FileName` | `string` | Name of the file that the recorded action was applied to | -| `FileType` | `string` | File extension type | +| `FileType` | `string` | File content type | | `SHA256` | `string` | SHA-256 of the file that the recorded action was applied to. This field is usually not populated — use the SHA1 column when available. | | `FileSize` | `long` | Size of the file in bytes | | `ThreatTypes` | `string` | Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats |