← Browse all tables

Loading table information…

EmailAttachmentInfo Schema

Table description

TableSection	TableType	TableSectionName	Description
Emails	Regular		Information about files attached to Office 365 emails

Table retention

HotDays	ColdDays	TotalInteractiveDays
30	0	30

Schema

Name	Description	Type
AdditionalFields	Additional information about the entity or event	Object
DetectionMethods	Methods used to detect malware, phishing, or other threats found in the email	String
FileExtension	File extension of the attachment.	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FileType	File extension type	String
NetworkMessageId	Unique identifier for the email, generated by Microsoft 365	String
RecipientEmailAddress	Email address of the recipient, or email address of the recipient after distribution list expansion	String
RecipientObjectId	Unique identifier for the email recipient in Microsoft Entra ID	String
ReportId	Unique identifier for the event	String
SenderDisplayName	Name of the sender displayed in the address book, typically a combination of a given or first name, a middle initial, and a last name or surname	String
SenderFromAddress	Sender email address in the FROM header, which is visible to email recipients on their email clients	String
SenderObjectId	Unique identifier for the sender’s account in Microsoft Entra ID	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
ThreatNames	Detection name for malware or other threats found	String
ThreatTypes	Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats	String
Timestamp	Date and time when the record was generated	DateTime

Schema changes

Date	Action
2026-08-19	Column AdditionalFields added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column _IsBillable removed
2026-01-02	Column _BilledSize removed
2026-01-02	Column FileExtension added
2024-10-18	Table added to tracking

EmailAttachmentInfo Schema

Table description

TableSection	TableType	TableSectionName	Description
Emails	Regular		Information about files attached to Office 365 emails

Table retention

HotDays	ColdDays	TotalInteractiveDays
30	0	30

Schema

Name	Description	Type
AdditionalFields	Additional information about the entity or event	Object
DetectionMethods	Methods used to detect malware, phishing, or other threats found in the email	String
FileExtension	File extension of the attachment.	String
FileName	Name of the file that the recorded action was applied to	String
FileSize	Size of the file in bytes	Int64
FileType	File extension type	String
NetworkMessageId	Unique identifier for the email, generated by Microsoft 365	String
RecipientEmailAddress	Email address of the recipient, or email address of the recipient after distribution list expansion	String
RecipientObjectId	Unique identifier for the email recipient in Microsoft Entra ID	String
ReportId	Unique identifier for the event	String
SenderDisplayName	Name of the sender displayed in the address book, typically a combination of a given or first name, a middle initial, and a last name or surname	String
SenderFromAddress	Sender email address in the FROM header, which is visible to email recipients on their email clients	String
SenderObjectId	Unique identifier for the sender’s account in Microsoft Entra ID	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
ThreatNames	Detection name for malware or other threats found	String
ThreatTypes	Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats	String
Timestamp	Date and time when the record was generated	DateTime

Schema changes

Date	Action
2026-08-19	Column AdditionalFields added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column TimeGenerated removed
2026-01-02	Column _IsBillable removed
2026-01-02	Column _BilledSize removed
2026-01-02	Column FileExtension added
2024-10-18	Table added to tracking