| AdditionalFields |
dynamic |
Additional information about the entity or event. |
| AttachmentCount |
int |
Number of attachments in the email. |
| AuthenticationDetails |
string |
List of pass or fail verdicts by email authentication protocols like DMARC, DKIM, SPF or a combination of multiple authentication types (CompAuth). |
| _BilledSize |
real |
The record size in bytes |
| BulkComplaintLevel |
int |
Threshold assigned to email from bulk mailers, a high bulk complaint level (BCL) means the email is more likely to generate complaints, and thus more likely to be spam. |
| ConfidenceLevel |
string |
List of confidence levels of any spam or phishing verdicts. For spam, this column shows the spam confidence level (SCL), indicating if the email was skipped (-1), found to be not spam (0,1), found to be spam with moderate confidence (5,6), or found to be spam with high confidence (9). For phishing, this column displays whether the confidence level is "High" or "Low". |
| Connectors |
string |
Custom instructions that define organizational mail flow and how the email was routed. |
| DeliveryAction |
string |
Action of the delivered email. |
| DeliveryLocation |
string |
Location of the delivered email: Inbox/Folder, On-premises/External, Junk, Quarantine, Failed, Dropped, Deleted items. |
| DetectionMethods |
string |
Delivery action of the email: Delivered, Junked, Blocked, or Replaced. |
| EmailAction |
string |
Final action taken on the email based on filter verdict, policies, and user actions: Move message to junk mail folder, Add X-header, Modify subject, Redirect message, Delete message, send to quarantine, No action taken, Bcc message. |
| EmailActionPolicy |
string |
Action policy that took effect: Antispam high-confidence, Antispam, Antispam bulk mail, Antispam phishing, Anti-phishing domain impersonation, Anti-phishing user impersonation, Anti-phishing spoof, Anti-phishing graph impersonation, Antimalware Safe Attachments, Enterprise Transport Rules (ETR). |
| EmailActionPolicyGuid |
string |
Unique identifier of the policy that took effect. |
| EmailClusterId |
long |
Identifier of the email cluster. Emails are clustered (grouped) based on heuristic analysis of their contents. |
| EmailDirection |
string |
Email direction: Inbound, Outbound, Intra-org. |
| EmailLanguage |
string |
Detected language of the email content. |
| InternetMessageId |
string |
Public-facing identifier for the email that is set by the sending email system. |
| _IsBillable |
string |
Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account |
| LatestDeliveryAction |
string |
Last known action attempted on an email by the service or by an admin through manual remediation. |
| LatestDeliveryLocation |
string |
Last known location of the email. |
| NetworkMessageId |
string |
Unique identifier for the email, generated by Office 365. |
| OrgLevelAction |
string |
Action taken on the email in response to matches to a policy defined at the organizational level. |
| OrgLevelPolicy |
string |
Organizational policy that triggered the action taken on the email. |
| RecipientEmailAddress |
string |
Recipient email address or email address of the recipient after distribution list expansion. |
| RecipientObjectId |
string |
Email recipient Azure AD identifier. |
| ReportId |
string |
Unique identifier for the event. |
| SenderDisplayName |
string |
Sender email address in the from header, which is visible to email recipients on their email clients. |
| SenderFromAddress |
string |
Sender domain in the from header, which is visible to email recipients on their email clients. |
| SenderFromDomain |
string |
Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats. |
| SenderIPv4 |
string |
IPv4 address of the last detected mail server that relayed the message. |
| SenderIPv6 |
string |
IPv6 address of the last detected mail server that relayed the message. |
| SenderMailFromAddress |
string |
Sender email address in the MAIL from header, also known as the envelope sender or the Return-Path address. |
| SenderMailFromDomain |
string |
Sender domain in the MAIL from header, also known as the envelope sender or the Return-Path address. |
| SenderObjectId |
string |
Sender email address in the from header, which is visible to email recipients on their email clients. |
| SourceSystem |
string |
The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics |
| Subject |
string |
Email subject field. |
| TenantId |
string |
The Log Analytics workspace ID |
| ThreatNames |
string |
Sender email address in the from header, which is visible to email recipients on their email clients. |
| ThreatTypes |
string |
Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats. |
| TimeGenerated |
datetime |
Date and time (UTC) when the record was generated. |
| Type |
string |
The name of the table |
| UrlCount |
int |
Number of embedded URLs in the email. |
| UserLevelAction |
string |
Action taken on the email in response to matches to a mailbox policy defined by the recipient. |
| UserLevelPolicy |
string |
End user mailbox policy that triggered the action taken on the email. |