EmailPostDeliveryEvents

EmailPostDeliveryEvents Schema #

Table description #

TableSection TableType TableSectionName Description
Emails Regular Security events that occur post-delivery, after Office 365 has delivered an email message to the recipient mailbox

Table retention #

HotDays ColdDays TotalInteractiveDays
30 0 30

Schema #

Name Description Type
Action Action taken on the entity String
ActionResult Result of the action String
ActionTrigger Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery String
ActionType Type of activity that triggered the event String
DeliveryLocation Location where the email was delivered: Inbox/Folder, On-premises/External, Junk, Quarantine, Failed, Dropped, Deleted items String
DetectionMethods Methods used to detect malware, phishing, or other threats found in the email String
EmailDirection Direction of the email relative to your network: Inbound, Outbound, Intra-org String
InternetMessageId Public-facing identifier for the email that is set by the sending email system String
NetworkMessageId Unique identifier for the email, generated by Microsoft 365 String
RecipientEmailAddress Email address of the recipient, or email address of the recipient after distribution list expansion String
ReportId Unique identifier for the event String
SenderFromAddress Sender email address in the FROM header, which is visible to email recipients on their email clients String
SourceSystem String
TenantId String
ThreatTypes Verdict from the email filtering stack on whether the email contains malware, phishing, or other threats String
TimeGenerated DateTime
Timestamp Date and time when the record was generated DateTime
Type String

Action types #

Name Description
Malware ZAP Zero-hour auto purge (ZAP) took action on an email message found containing malware after delivery.
Manual Remediation An administrator manually took action on an email message after it was delivered to the user mailbox. This includes actions taken manually through Threat Explorer or approvals of automated investigation and response (AIR) actions.
Phish ZAP Zero-hour auto purge (ZAP) took action on a phishing email after delivery.
Spam ZAP Zero-hour auto purge (ZAP) took action on spam email after delivery.

Schema changes #

Date Action
2026-01-02 Column _IsBillable removed
2026-01-02 Column _BilledSize removed
2026-01-02 Column SenderFromAddress added
2026-01-02 Column EmailDirection added
2024-10-18 Table added to tracking