Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Developer and API

Microsoft Sentinel ASIM Email Event normalization schema reference | Microsoft Learn

6 October 2026Doc update+259 / −0 lines

In brief

Microsoft added reference documentation for the ASIM Email Event schema, including email routing, authentication, delivery outcomes, and threat fields. It also documents the `_Im_EmailEvent` parser, custom parser naming, and filtering parameters.

What Defender admins need to know

Administrators can use the guidance to normalize and query email data consistently across mail servers, gateways, and inspection systems.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

layout: Conceptual title: Microsoft Sentinel ASIM Email Event normalization schema reference | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-email breadcrumb_path: breadcrumb/toc.json feedback_help_link_url: https://learn.microsoft.com/answers/tags/423/microsoft-sentinel/ feedback_help_link_type: get-help-at-qna feedback_product_url: https://feedback.azure.com/d365community/forum/79b1327d-d925-ec11-b6e6-000d3a4f06a4 feedback_system: Standard learn_banner_products:

Microsoft Sentinel ASIM Email Event normalization schema reference | Microsoft Learn

The Microsoft Sentinel Email Event normalization schema represents email delivery and inspection activity. It includes message addressing and routing details, email authentication results, delivery outcomes, and threats identified in email messages.

Use the Email Event schema to normalize records from mail servers, secure email gateways, email security services, and other systems that process or inspect email. Normalization lets you analyze these records with consistent field names and values, regardless of the source.

For more information about normalization in Microsoft Sentinel, see Normalization and the Advanced Security Information Model (ASIM).

Schema overview

The main fields of an email event describe:

  • The email activity, represented by EventType and EventSubType.
  • The sender and recipients, represented by EmailFromAddress, EmailToRecipients, EmailCCRecipients, and EmailBCCRecipients.
  • The message, represented by fields such as EmailSubject, EmailSizeBytes, EmailFiles, and EmailUrls.
  • Email authentication, represented by the SPF, DKIM, and DMARC fields.
  • The delivery outcome, represented by DvcAction, EmailDeliveryLocation, EventResult, and EventResultDetails.
  • Threats and inspection rules associated with the message, represented by the inspection fields.

The Dvc fields describe the reporting or inspecting system.

Parsers

Deploy and use email event parsers

Deploy ASIM parsers from the Microsoft Sentinel GitHub repository. To query all normalized email event sources, use the unifying parser _Im_EmailEvent as the table name in your query.

For more information about using ASIM parsers, see the ASIM parsers overview.

Add your own normalized parsers

When you implement custom parsers for the Email Event information model, use the following naming syntax:

  • ASimEmailEvent<vendor><Product> for regular parsers.
  • vimEmailEvent<vendor><Product> for parameterized parsers.

To add custom parsers to the Email Event unifying parser, see Manage ASIM parsers.

Filter parser results

The Email Event filtering parser supports filtering parameters to improve query performance.

NameTypeDescription
starttimedatetimeFilter events that started at or after this time.
endtimedatetimeFilter events that ended at or before this time.
ipaddr_has_any_prefixdynamicFilter events for which an IP address starts with one of the listed prefixes.
emailfromaddress_has_anydynamicFilter events for which EmailFromAddress contains one of the listed values.
emailrecipient_has_anydynamicFilter events that have one of the listed email recipients.
emailsubject_has_anydynamicFilter events for which EmailSubject contains one of the listed values.
emaildirection_indynamicFilter events for which EmailDirection is one of the listed values.
emaildeliverylocation_indynamicFilter events for which EmailDeliveryLocation is one of the listed values.
eventresultStringFilter events for which EventResult equals the specified value. The default value, *, doesn't filter by result.
packBooleanWhen set to true, pack unmapped source fields into the AdditionalFields dynamic field. The default is false.

For example, use the following query to return inbound email sent by addresses that contain contoso.com during the last day:

_Im_EmailEvent(starttime=ago(1d),endtime=now(),emailfromaddress_has_any=dynamic(['contoso.com']),emaildirection_in=dynamic(['Inbound'])
)

Schema details

Common ASIM fields

Important

Fields common to all schemas are described in detail in ASIM common fields. Guidelines in this article override the general guidelines for a field.

Common fields with specific guidelines

FieldClassTypeDescription
EventTypeMandatoryEnumeratedDescribes the normalized email activity. Allowed values are EmailDelivery and EmailInspection.
EventSubTypeOptionalEnumeratedProvides more detail about the email activity. Allowed values are EmailSent and EmailReceived.
EventSchemaMandatoryEnumeratedThe schema name is EmailEvent.
EventSchemaVersionMandatorySchemaVersion (String)The version of the schema. The version documented here is 1.0.0.
EventResultDetailsRecommendedEnumeratedProvides details about the result. Allowed values are InvalidAddress, MailboxFull, MessageTooLarge, MessageRateLimitExceeded, RecipientRateLimitExceeded, BlockedByPolicy, BlockedBySpamFilter, PhishingDetected, MalwareDetected, and Other.
EventSeverityRecommendedEnumeratedThe event severity. Allowed values are Informational, Low, Medium, and High.

All common fields

ClassFields
Mandatory- EventCount- EventStartTime- EventEndTime- EventType- EventResult- EventProduct- EventVendor- EventSchema- EventSchemaVersion- Dvc
Recommended- EventResultDetails- EventSeverity- EventUid- DvcIpAddr- DvcHostname- DvcDomain
Optional- EventMessage- EventSubType- EventOriginalUid- EventOriginalType- EventOriginalResultDetails- EventOriginalSeverity- EventProductVersion- EventReportUrl- EventOwner- DvcDescription- DvcFQDN- DvcId- DvcInterface- DvcMacAddr- DvcOriginalAction- DvcOs- DvcOsVersion- DvcScope- DvcScopeId- DvcZone- AdditionalEntities- AdditionalFields
Conditional- DvcDomainType- DvcIdType

Email fields

FieldClassTypeDescription
EmailFromAddressRecommendedStringThe email address in the message From header.
EmailFromDomainOptionalStringThe domain from the address in the message From header.
EmailMailFromAddressOptionalStringThe envelope sender address used by the mail transport protocol.
EmailMailFromDomainOptionalStringThe domain of the envelope sender address.
EmailReplyToAddressRecommendedStringThe email address in the message Reply-To header.
EmailReplyToDomainOptionalStringThe domain from the address in the message Reply-To header.
EmailToRecipientsRecommendedDynamicAn array of recipients in the message To header.
EmailCCRecipientsOptionalDynamicAn array of recipients in the message Cc header.
EmailBCCRecipientsOptionalDynamicAn array of recipients in the message Bcc header.
EmailSubjectRecommendedStringThe email subject.
EmailLanguageOptionalStringThe language of the email content, as reported by the source.
EmailSizeBytesRecommendedLongThe total email size in bytes.
EmailProtocolNameRecommendedEnumeratedThe protocol used to transfer or retrieve the email. Allowed values are SMTP, IMAP, and POP3.
EmailDirectionRecommendedEnumeratedThe direction of the email relative to the reporting environment. Allowed values are Inbound, Outbound, Internal, Local, and Unknown.
EmailDeliveryLocationOptionalEnumeratedThe normalized location where the email was delivered. Allowed values are Inbox, Junk, Quarantine, and DeletedItems.
EmailOriginalDeliveryLocationOptionalStringThe delivery location as reported by the source.
EmailFileCountRecommendedIntegerThe number of files attached to the email.
EmailFilesOptionalDynamicAn array that describes files attached to the email.
EmailUrlCountRecommendedIntegerThe number of URLs found in the email.
EmailUrlsOptionalDynamicAn array of URLs found in the email.

Email authentication fields

FieldClassTypeDescription
EmailSpfResultOptionalEnumeratedThe normalized Sender Policy Framework (SPF) result. Allowed values are Pass, Fail, SoftFail, Neutral, None, TemporaryError, and PermanentError.
EmailSpfOriginalResultOptionalStringThe SPF result as reported by the source.
EmailDkimDomainOptionalStringThe domain that signed the message with DomainKeys Identified Mail (DKIM).
EmailDkimSignatureOptionalStringThe DKIM signature associated with the message.
EmailDkimResultOptionalEnumeratedThe normalized DKIM result. Allowed values are Pass, Fail, TemporaryError, PermanentError, and None.
EmailDkimOriginalResultOptionalStringThe DKIM result as reported by the source.
EmailDmarcResultOptionalEnumeratedThe normalized Domain-based Message Authentication, Reporting, and Conformance (DMARC) result. Allowed values are Pass, Fail, BestGuessPass, and None.
EmailDmarcOriginalResultOptionalStringThe DMARC result as reported by the source.
EmailDmarcPolicyOptionalEnumeratedThe DMARC policy applied to the email. Allowed values are Quarantine, Reject, and None.
EmailDmarcOverrideOptionalEnumeratedThe reason the DMARC policy was overridden. Allowed values are Forwarded, LocalPolicy, MailingList, SampleOut, TrustedForwarder, and Other.

Delivery and destination fields

FieldClassTypeDescription
DvcActionOptionalEnumeratedThe normalized action taken on the email. Allowed values are Delivered, Modified, Redirected, Blocked, Quarantined, Deleted, Purged, and NA.
DstMandatoryStringA unique identifier for the email destination.
DstIpAddrRecommendedIP addressThe IP address of the email destination.

Source system fields

FieldClassTypeDescription
SrcRecommendedStringA unique identifier for the source system.
SrcIpAddrOptionalIP addressThe source IP address.
IpAddrAliasIP addressAlias to SrcIpAddr.
SrcHostnameRecommendedHostnameThe source device hostname, excluding domain information.
SrcDomainRecommendedDomainThe domain of the source device.
SrcDomainTypeConditionalEnumeratedThe type of SrcDomain. Allowed values are Windows, FQDN, and ResourceGroup. Required when SrcDomain is used.
SrcFQDNOptionalFQDNThe fully qualified domain name of the source device.
SrcDvcIdOptionalStringThe ID of the source device.
SrcDvcIdTypeConditionalEnumeratedThe type of SrcDvcId. Allowed values are AzureResourceId, MDEid, MD4IoTid, VMConnectionId, AwsVpcId, VectraId, ForcepointId, AppGateId, and Other. Required when SrcDvcId is used.
SrcDvcScopeOptionalStringThe cloud platform scope to which the source device belongs.
SrcDvcScopeIdOptionalStringThe ID of the cloud platform scope to which the source device belongs.
SrcDeviceTypeOptionalEnumeratedThe source device type.
SrcDescriptionOptionalStringA description of the source device.
SrcIspOptionalStringThe internet service provider associated with the source IP address.
SrcGeoCountryOptionalStringThe country or region associated with the source IP address.
SrcGeoRegionOptionalStringThe region associated with the source IP address.
SrcGeoCityOptionalStringThe city associated with the source IP address.
SrcGeoLatitudeOptionalRealThe latitude associated with the source IP address.
SrcGeoLongitudeOptionalRealThe longitude associated with the source IP address.

Source user fields

FieldClassTypeDescription
SrcUserNameOptionalStringThe source user's name.
UserAliasStringAlias to SrcUserName.
SrcUserUpnRecommendedStringThe source user's User Principal Name (UPN).
SrcUserIdOptionalStringA machine-readable identifier for the source user.
SrcUserIdTypeOptionalEnumeratedThe type of SrcUserId. Allowed values are SID, UID, AADID, OktaId, AWSId, PUID, SalesforceId, VectraUserId, MD4IoTid, and Other.
SrcUsernameTypeOptionalEnumeratedThe type of the value in SrcUserName.
SrcUserScopeOptionalStringThe scope in which the source user is defined.
SrcUserScopeIdOptionalStringThe ID of the scope in which the source user is defined.

Inspection fields

The following fields describe the rule, threat, or indicator associated with email inspection.

FieldClassTypeDescription
RuleNameOptionalStringThe name or ID of the inspection rule.
RuleNumberOptionalIntegerThe numeric ID of the inspection rule.
RuleAliasStringAlias to RuleName.
RuleDescriptionOptionalStringA description of the inspection rule.
IndicatorTypeOptionalEnumeratedThe type of indicator identified in the email event.
IndicatorAssociationOptionalEnumeratedThe association between the indicator and the email event.
ThreatIdOptionalStringThe ID of the threat identified in the email.
ThreatNameOptionalStringThe name of the threat identified in the email.
ThreatCategoryOptionalStringThe normalized threat category.
ThreatOriginalCategoryOptionalStringThe threat category as reported by the source.
ThreatRiskLevelOptionalRiskLevel (Integer)The normalized threat risk level, from 0 through 100.
ThreatOriginalRiskLevelOptionalStringThe threat risk level as reported by the source.
ThreatConfidenceOptionalConfidenceLevel (Integer)The normalized confidence level, from 0 through 100.
ThreatOriginalConfidenceOptionalStringThe threat confidence as reported by the source.
ThreatIsActiveOptionalBooleanIndicates whether the identified threat is active.
ThreatFirstReportedTimeOptionalDatetimeThe first time the threat was reported.
ThreatLastReportedTimeOptionalDatetimeThe last time the threat was reported.
ThreatIpAddrOptionalIP addressAn IP address associated with the identified threat.
ThreatFieldConditionalEnumeratedThe field for which the threat was identified.
AttackTacticsOptionalStringThe MITRE ATT&CK tactics associated with the email event.
AttackTechniquesOptionalStringThe MITRE ATT&CK techniques associated with the email event.
AttackRemediationStepsOptionalStringRecommended steps to remediate the identified attack or threat.

Schema updates

Version 1.0.0 is the initial release of the Email Event schema. \ No newline at end of file