Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
The MessageUrlInfo table in the advanced hunting schema contains information about URLs sent through Microsoft Teams messages in your organization.
This advanced hunting table is populated by records from Microsoft Defender for Office 365. If your organization hasn’t deployed the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Office 365 in Defender XDR, read Deploy supported services.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
| Column name | Data type | Description |
|---|---|---|
Timestamp |
datetime |
Date and time when the event was recorded |
TeamsMessageId |
string |
Unique identifier for the message, as generated by Microsoft 365 |
Url |
string |
URL from message |
UrlDomain |
string |
Domain name or host name of the URL |
ThreatTypes |
string |
Verdict from the filtering stack on whether the message contains malware, phishing, or other threats |
ReportId |
string |
Unique identifier for the event |
Related topics
Tip
Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender XDR Tech Community.