| title | CampaignInfo table in the advanced hunting schema | ||
|---|---|---|---|
| description | Learn about the CampaignInfo table of the advanced hunting schema | ||
| search.appverid | met150 | ||
| ms.service | defender-xdr | ||
| ms.subservice | adv-hunting | ||
| f1.keywords |
|
||
| ms.author | pauloliveria | ||
| author | poliveria | ||
| ms.localizationpriority | medium | ||
| manager | orspodek | ||
| audience | ITPro | ||
| ms.collection |
|
||
| ms.custom |
|
||
| appliesto |
|
||
| ms.topic | reference | ||
| ms.date | 12/04/2025 |
[!INCLUDE Microsoft Defender XDR rebranding]
Important
Some information relates to prereleased product which might be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
The CampaignInfo table in the advanced hunting schema contains information about email campaigns identified by Microsoft Defender for Office 365. Use this reference to construct queries that return information from this table.
This advanced hunting table is populated by records from Defender for Office 365. If your organization didn't deploy the service in Microsoft Defender XDR, queries that use the table aren’t going to work or return any results. For more information about how to deploy Defender for Office 365 in Defender XDR, read Deploy supported services.
For information on other tables in the advanced hunting schema, see the advanced hunting reference.
| Column name | Data type | Description |
|---|---|---|
Timestamp |
datetime |
Date and time when the event was recorded |
CampaignName |
string |
Name of the email campaign |
CampaignId |
string |
Unique identifier for the campaign, generated by Microsoft Defender for Office 365 |
CampaignType |
string |
Category of the campaign, like Phish, Malware, Spam, and others |
CampaignSubtype |
string |
Contains more details about the campaign, like the brand being phished or related malware campaigns, if available |
NetworkMessageId |
string |
Unique identifier for the email, generated by Microsoft Defender for Office 365 |
RecipientEmailAddress |
string |
Email address of the recipient, or email address of the recipient after distribution list expansion |
ReportId |
string |
Unique identifier for the event |