Advanced hunting - EmailsEvents shema is gone ?

[EtienneFiset]

Hey Guys,

the emailsevent shema is gone from my console, actually, a lot of things have changed since last week and i cannot perform any query to find emailSenderAddress/domain of even the subject or file.... it seem that Microsoft removed it...

https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-emailevents-table...

The Alert section is new for me and the apps&identities....

Do you have any idea what kind of query i need to perform now to doing that ? i tried a couple one from the new section, seem to not working..

[#2]

I've noticed this as well, although in my case it has happened overnight as I was using it yesterday afternoon. I don't remember there having been any notifications about this being taken away so I'm hoping it's just a 'glitch', but if this is gone for good then I've lost a great tool for investigating. Explorer is still working but I prefer using Advanced Hunting so I hope it comes back.

[#3]

Yeah, i noticed they put the all queries directly in the Explorer now, maybe they have just switched in there, but i hope that will indeed comes back in AH section

[#4 · Accepted solution]

Hi Etienne

I've just had another check and the EmailEvents schema is back for me in Advanced Hunting, under Email and Collaboration so it looks like it must have just been a 'glitch'. Let's hope that it's also back for you too my friend :)

[#5]

You are right, it appears again !!!!