Forum Discussion

EtienneFiset's avatar
EtienneFiset
Brass Contributor
Mar 01, 2023

Advanced hunting - EmailsEvents shema is gone ?

Hey Guys,

 

the emailsevent shema is gone from my console, actually, a lot of things have changed since last week and i cannot perform any query to find emailSenderAddress/domain of even the subject or file.... it seem that Microsoft removed it...

 

https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-emailevents-table?view=o365-worldwide

 

The Alert section is new for me and the apps&identities....

 

 

Do you have any idea what kind of query i need to perform now to doing that ? i tried a couple one from the new section, seem to not working..

 

 

  • kismat's avatar
    kismat
    Mar 02, 2023
    Hi Etienne

    I've just had another check and the EmailEvents schema is back for me in Advanced Hunting, under Email and Collaboration so it looks like it must have just been a 'glitch'. Let's hope that it's also back for you too my friend 🙂
  • kismat's avatar
    kismat
    Brass Contributor
    I've noticed this as well, although in my case it has happened overnight as I was using it yesterday afternoon. I don't remember there having been any notifications about this being taken away so I'm hoping it's just a 'glitch', but if this is gone for good then I've lost a great tool for investigating. Explorer is still working but I prefer using Advanced Hunting so I hope it comes back.
    • EtienneFiset's avatar
      EtienneFiset
      Brass Contributor
      Yeah, i noticed they put the all queries directly in the Explorer now, maybe they have just switched in there, but i hope that will indeed comes back in AH section
      • kismat's avatar
        kismat
        Brass Contributor
        Hi Etienne

        I've just had another check and the EmailEvents schema is back for me in Advanced Hunting, under Email and Collaboration so it looks like it must have just been a 'glitch'. Let's hope that it's also back for you too my friend 🙂

Resources