· security
UnifiedEmailData: A KQL function for simplified email hunting in Microsoft Defender XDR
Email hunting in Defender XDR means juggling four tables. UnifiedEmailData is a parameterized KQL function that returns one row per email with all attachments, URLs and post-delivery actions nested, including built-in filters that keep the query cheap.