{"id":12783,"date":"2025-09-09T09:02:21","date_gmt":"2025-09-09T00:02:21","guid":{"rendered":"https:\/\/m365jp.net\/?p=12783"},"modified":"2025-09-09T09:06:11","modified_gmt":"2025-09-09T00:06:11","slug":"mc1150118-microsoft-defender-for-office-365-new-records-in-streaming-api-and-sentinel-emailevents-table","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2025-09-09-mc1150118-microsoft-defender-for-office-365-new-records-in-streaming-api-and-sentinel-emailevents-table","title":{"rendered":"MC1150118 | Microsoft Defender for Office 365: New records in Streaming API and Sentinel EmailEvents table"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC1150118 | Microsoft Defender for Office 365: New records in Streaming API and Sentinel EmailEvents table<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n\n
Classification<\/th>\nplanForChange<\/td>\n<\/tr>\n
Last Updated<\/th>\n09\/08\/2025 23:28:17<\/td>\n<\/tr>\n
Start Time<\/th>\n09\/08\/2025 23:28:04<\/td>\n<\/tr>\n
End Time<\/th>\n01\/31\/2026 08:00:00<\/td>\n<\/tr>\n
Message Content<\/th>\n[Introduction]<\/b> <\/p>\n

To improve visibility and alignment across Microsoft Defender for Office 365 and Microsoft Sentinel, we\u2019re updating how email verdict and location changes are handled in the EmailEvents<\/i> table. This change ensures that Sentinel reflects both current and historical verdicts, enabling more accurate threat analysis and investigation.<\/p>\n

[When this will happen:]<\/b> <\/p>\n

General Availability:<\/b> Rollout begins in early October 2025<\/b> and is expected to complete by early November 2025<\/b>.<\/p>\n

[How this affects your organization:]<\/b> <\/p>\n

    <\/p>\n
  • Who is affected:<\/b> Admins using Microsoft Defender for Office 365<\/i>, Streaming API<\/i>, and the EmailEvents<\/i> table in Microsoft Sentinel.<\/li>\n

    <\/p>\n

  • What will happen:<\/b>
    \n
      <\/p>\n
    • The Streaming API<\/i> will begin streaming updated records when an email\u2019s verdict or location changes.<\/li>\n

      <\/p>\n

    • Microsoft Sentinel will store both the updated and previous records, rather than replacing them.<\/li>\n

      <\/p>\n

    • You may see multiple rows for the same email if its verdict or location is updated.<\/li>\n

      <\/p>\n

    • This update aligns the EmailEvents<\/i> table in Microsoft Sentinel with the behavior of the Advanced Hunting<\/i> EmailEvents<\/i> table.<\/li>\n

      <\/ul>\n

      <\/li>\n

      <\/ul>\n

      [What you can do to prepare:]<\/b> <\/p>\n

Machine Translation<\/th>\n[\u306f\u3058\u3081\u306b]<\/b> <\/p>\n

Microsoft Defender for Office 365\u3068Microsoft Sentinel\u5168\u4f53\u306e\u53ef\u8996\u6027\u3068\u6574\u5408\u6027\u3092\u5411\u4e0a\u3055\u305b\u308b\u305f\u3081\u306b\u3001 EmailEvents<\/i> \u30c6\u30fc\u30d6\u30eb\u3067\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u306e\u5224\u5b9a\u3068\u5834\u6240\u306e\u5909\u66f4\u306e\u51e6\u7406\u65b9\u6cd5\u3092\u66f4\u65b0\u3057\u3066\u3044\u307e\u3059\u3002\u3053\u306e\u5909\u66f4\u306b\u3088\u308a\u3001Sentinel \u306f\u73fe\u5728\u3068\u904e\u53bb\u306e\u4e21\u65b9\u306e\u8a55\u5b9a\u3092\u53cd\u6620\u3057\u3001\u3088\u308a\u6b63\u78ba\u306a\u8105\u5a01\u5206\u6790\u3068\u8abf\u67fb\u304c\u53ef\u80fd\u306b\u306a\u308a\u307e\u3059\u3002<\/p>\n

[\u3053\u308c\u304c\u3044\u3064\u8d77\u3053\u308b\u304b:]<\/b> <\/p>\n

\u4e00\u822c\u63d0\u4f9b<\/b> :\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u306f 2025 \u5e74 10 \u6708\u521d\u65ec<\/b> \u306b\u958b\u59cb\u3055\u308c\u3001 2025 \u5e74 11 \u6708\u521d\u65ec<\/b>\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n

[\u3053\u308c\u304c\u3042\u306a\u305f\u306e\u7d44\u7e54\u306b\u4e0e\u3048\u308b\u5f71\u97ff:]<\/b> <\/p>\n