I hope you are well. I have a quick question which I'd like to understand if you could help me:
Basically I've been working with Advanced Hunting to try to get some customized data, reports and so on in terms of for instance impersonation, url protection, etc... Reason to do this is because we would like to have some views, reports, tables customized whatever way we prefer...
That said I got stuck here in something: lets say URL threats protection, I can play with the data of the EmailEvents table, however if I want to distinguish which type of users are having some behaviours I cannot do anything as that information is not in any of the available advanced hunting tables, but it is in the O365 URL predefined reports - basically would distinguish if user is a Protected User or not - that is defined on the Phishing Policy...
so this was just an example but main question is are we limited on Advanced Hunting to those tables, or is there anywhere where we can grab for instance that field I am missing in this example using Adv Hunting and Kusto QL
Thanks a million,
