Jun 13 2024 12:43 PM
Hi Sentinel Community,
I am encountering an issue where the email subject line is not being captured correctly for certain records in my URL click event table. My goal is to get the URLs clicked by users along with the corresponding email subject lines. To achieve this, I applied a left outer join between the URL click event table and the email event table based on the network message ID.
However, after running the query, I notice that the subject column is empty for some records where users have clicked the URL, which was originally sent via email
the query which i used
UrlClickEvents
| search "email address removed for privacy reasons" // user name
| join kind= leftouter EmailEvents on $left.NetworkMessageId== $right.NetworkMessageId
//| where RecipientEmailAddress=="example.com"
| join kind= leftouter EmailPostDeliveryEvents on $left.NetworkMessageId== $right.NetworkMessageId
//|where isempty( Subject) and Workload =~"email"
| project TimeGenerated,Subject,SenderFromAddress=hash_sha256(SenderFromAddress),RecipientEmailAddress=hash_sha256(RecipientEmailAddress),Url=hash_md5(Url),Workload,NetworkMessageId=hash_md5(NetworkMessageId)
Jun 14 2024 12:47 AM
Jun 14 2024 11:30 AM