Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Hunting and detection

Advanced Hunting Query Emails Devices

4 September 2026Doc update+4 / −4 lines

In brief

The article date was updated, and explanatory text was revised to clarify extracting the account name from recipient email addresses and checking logon activity on a recipient's device after ZAP processing.

What Defender admins need to know

Administrators can use the clarified descriptions when interpreting these advanced hunting queries; no configuration change is indicated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

When constructing queries across tables that cover devices and emails, you will likely need to obtain user account names from sender or recipient email addresses. You can generally do this for either recipient or sender address using the local-host from the email address.

In the snippet below, we use the tostring() Kusto function to extract the local-host right before the @ from recipient email addresses in the column RecipientEmailAddress. This snippet extracts the account name from RecipientEmailAddress so you can reuse it in joins with identity or device data:

//Query snippet showing how to extract the account name from an email address

### Get device information

The [advanced hunting schema](advanced-hunting-schema-tables.md) provides extensive device information in various tables. For example, the [DeviceInfo table](advanced-hunting-deviceinfo-table.md) provides comprehensive device information based on event data aggregated regularly. This query uses the `DeviceInfo` table to check if a potentially compromised user (`<account-name>`) has logged on to any devices and then lists the alerts that have been triggered on those devices.the devices that the user has logged on to.

List logon activities of users that received emails that were not zapped successfully

Zero-hour auto purge (ZAP) addresses malicious emails after they have been received. If ZAP fails, malicious code might eventually run on thea recipient's device and leave accounts compromised. This query checks for logon activity made by the recipients of emails that were not successfully addressed by ZAP.

EmailPostDeliveryEvents