Forum Discussion
Defender API question... EmailEvents Table, IdentityInfo table?
Defender API Question....
Is there a way to query the EmailEvents table through an api? Or the Identityinfo table?
I'm currently testing through -
api-us.securitycenter.microsoft.com
and playing around with the available tables to query, there doesn't seem to be much other than the Device* tables.
Also, I've got the Microsoft api reference links from here,
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/exposed-apis-list?view=o365-worldwide.
And I'm going through the Azure Sentinel Notebooks and the msticpy notebooks, but I'd appreciate any videos or blogs about exploring the tables and data through the api and jupyter notebooks.
This is really super cool!
1 Reply
Hi mathurin68,
You need to query the Microsoft 365 Defender Advanced Hunting API in order to access email-related events (as these aren't Microsoft Defender for Endpoint events), e.g.:
POST https://api.security.microsoft.com/api/advancedhunting/run
{"Query": "EmailEvents | where Timestamp > ago(5d) | project Timestamp, SenderFromAddress, SenderFromDomain, SenderIPv4, RecipientEmailAddress | top 10 by Timestamp desc"}
