Introducing the Microsoft Sentinel ASIM EmailEvent schema

Email remains one of the most common entry points for security threats. Yet email products often describe the same activity with different table names, fields, and values. This makes it harder to build detections and investigations that work consistently across data sources.