Email and collaboration / Security event
EmailEvents
Email delivery events including sender, recipient, subject, delivery action, and threat verdicts
Recommendation
High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.
How the matrix worksC5 Network activity
Network activity: firewall, DNS, DHCP, web proxy, flow, load balancer, mail gateway and message flow, web access to internet-facing services
ACSC
- 2. Network device logs
- 8. Cloud platform logging
- 12. Windows DNS server analytic event logs
CISA
- 3. Network device infrastructure3a-3c DNS query and response, DHCP lease information, and firewall logs
MITRE data sources
- Application Log: Application Log Content
T1 Near-real-time detection
Generic detections need near-real-time matching on single events.
Lake supported in the Azure Monitor table feature matrix
Fields detections use
High-value fields
Most used in public rules
EmailDirection179ThreatTypes131OrgLevelPolicy112DetectionMethods91NetworkMessageId72RecipientEmailAddress64SenderFromAddress61Subject51DeliveryLocation42DeliveryAction41OrgLevelAction30SenderFromDomain28
Sources for this recommendation
- Log Horizon classification baseline Initial per-table classifications, recommendations, lifecycle state, and descriptive metadata migrated without semantic changes.
- Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
- Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.
- Microsoft Defender XDR advanced hunting schema reference Table identity, description, preview state, lifecycle, and columns for Defender XDR advanced hunting tables, including the per-table reference pages linked from the index. Field analysis uses the columns for XDR-only tables such as EntraIdSignInEvents.