KQL Search

This query is designed to gather information about Microsoft Teams messages within an organization using Microsoft Defender for Office 365. Here's a simple breakdown of what the query does:

1. Data Sources:

   • The query uses two tables: MessageEvents and MessageUrlInfo.
   • MessageEvents contains details about messages sent and received at the time of delivery.
   • MessageUrlInfo contains information about URLs included in Microsoft Teams messages.

2. Purpose:

   • The goal is to retrieve information about Teams messages and any URLs that were included in those messages.

3. How It Works:

   • The query performs a "left outer join" operation between the MessageEvents table and the MessageUrlInfo table.
   • It matches records from both tables based on a common field called TeamsMessageId.
   • This means it will take all records from MessageEvents and add any matching URL information from MessageUrlInfo based on the TeamsMessageId.

4. Outcome:

   • The result will be a combined dataset that includes details of Teams messages along with any URLs that were part of those messages, even if some messages don't have associated URLs.

In summary, this query is used to analyze Microsoft Teams messages and any URLs they contain, helping to monitor and investigate communication within an organization.