Loading table information…
Contribute structured examples for this table using the PowerShell tool. Submit a synthetic example.
EmailUrlInfo Schema
Table description
| TableSection | TableType | TableSectionName | Description | Source |
|---|---|---|---|---|
| Emails | Regular | Information about URLs on Office 365 emails | Defender |
Table retention
| ColdDays | HotDays | TotalInteractiveDays |
|---|---|---|
| 0 | 30 | 30 |
Schema
| Name | Description | Type |
|---|---|---|
| NetworkMessageId | Unique identifier for the email, generated by Microsoft 365 | String |
| ReportId | Unique identifier for the event | String |
| SourceSystem | String | |
| TenantId | String | |
| TimeGenerated | DateTime | |
| Timestamp | Date and time when the record was generated | DateTime |
| Type | String | |
| Url | Full Url from email | String |
| UrlChainId | Unique identifier for the root url | String |
| UrlChainPosition | Position of a url in a nested url list | Int32 |
| UrlDomain | Domain name or host name of the URL | String |
| UrlLocation | Indicates which part of the email the URL is located | String |
Schema changes
| Date | Action |
|---|---|
| 2026-10-07 | Column TenantId added |
| 2026-10-07 | Column Type added |
| 2026-10-07 | Column SourceSystem added |
| 2026-10-07 | Column TimeGenerated added |
| 2026-02-27 | Column TenantId removed |
| 2026-02-27 | Column Type removed |
| 2026-02-27 | Column SourceSystem removed |
| 2026-02-27 | Column TimeGenerated removed |
| 2026-01-02 | Column _IsBillable removed |
| 2026-01-02 | Column _BilledSize removed |
| 2026-01-02 | Column UrlChainId added |
| 2026-01-02 | Column UrlChainPosition added |
| 2024-10-18 | Table added to tracking |
Known observations
Value casing varies
Fields: Url.
Values in this field have been observed with different casing. Choose comparison behavior according to the meaning of the value and the query intent.
Sources: Olaf Hartong.