Edit

Share via

MessagePostDeliveryEvents (Preview)

  • Applies to: Microsoft Defender XDR, Microsoft Sentinel in the Microsoft Defender portal

Important

Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

The MessagePostDeliveryEvents table in the advanced hunting schema contains information about security events that occurred after the delivery of a Microsoft Teams message in your organization.

This advanced hunting table is populated by records from Microsoft Defender for Office 365. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Office 365 in Defender XDR, read Deploy supported services.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column name Data type Description
Timestamp datetime Date and time when the event was recorded
TeamsMessageId string Unique identifier for the message, as generated by Microsoft 365
Action string Action taken on the message: Blocked, Moved to quarantine
ActionType string Type of activity that triggered the event: Manual remediation, Phish ZAP, Malware ZAP
ActionTrigger string Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery
ActionResult string Result of the action
SenderEmailAddress string Email address of the sender
RecipientDetails dynamic Array of recipient data (RecipientSmtpAddress, RecipientDisplayName, RecipientType, RecipientObjectId)
ThreatTypes string Verdict from the filtering stack on whether the message contains malware, phishing, or other threats
ConfidenceLevel dynamic List of confidence levels for each threat type identified
DetectionMethods string Methods used to detect malware, phishing, or other threats found in the message
LatestDeliveryLocation string Last known location of the message
ReportId string Unique identifier for the event
IsExternalThread boolean Indicates if there are external recipients in the thread (1) or none (0)

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.