Microsoft Sentinel
Cloud and workloadsNormalization About Schemas
In brief
The schema reference now lists the Email Event schema as `EmailEvent`, version 1.0.0, with GA status.
What Defender admins need to know
Administrators can use the updated reference when working with normalized email event data. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Authentication Event | Authentication | 1.0.0 | GA |
| DHCP Activity | DhcpEvent | 1.0.0 | GA |
| DNS Activity | Dns | 1.0.0 | GA |
| Email Event | EmailEvent | 1.0.0 | GA |
| File Activity | FileEvent | 1.0.0 | GA |
| Network Session | NetworkSession | 1.0.0 | GA |
| Process Event | ProcessEvent | 1.0.0 | GA |
@@ -67,6 +67,7 @@ Schema references outline the fields that comprise each schema. ASIM currently d | [Authentication Event](normalization-schema-authentication) | `Authentication` | 1.0.0 | GA |
| [DHCP Activity](normalization-schema-dhcp) | `DhcpEvent` | 1.0.0 | GA |
| [DNS Activity](normalization-schema-dns) | `Dns` | 1.0.0 | GA |
+| [Email Event](normalization-schema-email) | `EmailEvent` | 1.0.0 | GA |
| [File Activity](normalization-schema-file-event) | `FileEvent` | 1.0.0 | GA |
| [Network Session](normalization-schema) | `NetworkSession` | 1.0.0 | GA |
| [Process Event](normalization-schema-process-event) | `ProcessEvent` | 1.0.0 | GA |