Skip to content
Connectors
/
/
Email Security Supported...

Email Security Supported Fields

This document shows the fields supported by each provider and operation.

get_threat_details

FieldIronscalesMicrosoft DefenderMimecast Cloud GatewayType
action❌✅✅string
action_id❌✅✅number
activity_id✅✅✅number
activity_name✅✅✅string
category_name✅✅✅string
category_uid✅✅✅number
class_name✅✅✅string
class_uid✅✅✅number
confidence_score✅❌❌number
disposition❌✅✅string
disposition_id❌✅✅number
evidences[].email.attachment_count✅✅❌number
evidences[].email.files[].ext❌❌✅string
evidences[].email.files[].hashes[].algorithm✅❌✅string
evidences[].email.files[].hashes[].algorithm_id✅❌✅number
evidences[].email.files[].hashes[].value✅❌✅string
evidences[].email.files[].mime_type❌❌✅string
evidences[].email.files[].name✅❌✅string
evidences[].email.files[].size✅❌✅number
evidences[].email.files[].type✅❌✅string
evidences[].email.files[].type_id✅❌✅number
evidences[].email.from✅✅✅string
evidences[].email.message_uid❌✅✅string
evidences[].email.reply_to_list[]✅❌❌string
evidences[].email.return_path❌✅❌string
evidences[].email.sender❌❌✅string
evidences[].email.size❌✅✅number
evidences[].email.subject✅✅✅string
evidences[].email.to[]✅✅✅string
evidences[].email.uid❌✅❌string
evidences[].email.url_count✅✅❌number
evidences[].email.urls[].url_string✅❌❌string
evidences[].src_endpoint.hostname✅❌❌string
evidences[].src_endpoint.ip✅❌❌string
evidences[].uid✅❌❌string
finding_info.created_time✅❌❌timestamp
finding_info.created_time_dt✅❌❌string
finding_info.modified_time✅❌❌timestamp
finding_info.modified_time_dt✅❌❌string
finding_info.related_events[].uid✅❌❌string
finding_info.tags[].name✅❌❌string
finding_info.tags[].value✅❌❌string
finding_info.types[]✅❌❌string
finding_info.uid✅✅✅string
metadata.extensions[].name✅✅✅string
metadata.extensions[].uid✅✅✅string
metadata.extensions[].version✅✅✅string
metadata.product.name✅✅✅string
metadata.product.vendor_name✅✅✅string
metadata.profiles[]✅✅✅string
metadata.tenant_uid✅❌❌string
metadata.version✅✅✅string
observables[].name✅✅❌string
observables[].type✅✅❌string
observables[].type_id✅✅❌number
observables[].value✅✅❌string
policy.type❌✅❌string
policy.uid❌✅❌string
severity✅✅✅string
severity_id✅✅✅number
time✅✅✅number
time_dt✅✅✅string
timezone_offset✅✅✅number
type_name✅✅✅string
type_uid✅✅✅number

query_email_events

FieldMicrosoft 365 Management ActivityMicrosoft DefenderMicrosoft Exchange OnlineType
action❌✅❌string
action_id❌✅❌number
activity_id✅✅✅number
activity_name✅✅✅string
actor.app_name✅❌❌string
actor.user.name✅❌❌string
actor.user.uid✅❌❌string
category_name✅✅✅string
category_uid✅✅✅number
class_name✅✅✅string
class_uid✅✅✅number
direction✅✅✅string
direction_id✅✅✅number
disposition❌✅❌string
disposition_id❌✅❌number
dst_endpoint.ip❌❌✅string
email.attachment_count✅✅❌number
email.bcc[]✅❌❌string
email.cc[]✅❌❌string
email.files[].ext✅✅❌string
email.files[].hashes[].algorithm❌✅❌string
email.files[].hashes[].algorithm_id❌✅❌number
email.files[].hashes[].value❌✅❌string
email.files[].name✅✅❌string
email.files[].size✅✅❌number
email.files[].type✅✅❌string
email.files[].type_id✅✅❌number
email.from✅✅✅string
email.is_delivered❌✅✅boolean
email.message_uid✅✅✅string
email.return_path❌✅❌string
email.sender✅❌❌string
email.size✅✅✅number
email.subject✅✅✅string
email.to[]✅✅✅string
email.uid✅✅✅string
email.url_count❌✅❌number
email.urls[].hostname❌✅❌string
email.urls[].path❌✅❌string
email.urls[].query_string❌✅❌string
email.urls[].scheme❌✅❌string
email.urls[].url_string❌✅❌string
email_auth.dkim❌✅❌string
email_auth.dmarc❌✅❌string
email_auth.spf❌✅❌string
from✅❌✅string
message_trace_uid❌❌✅string
metadata.extensions[].name✅✅✅string
metadata.extensions[].uid✅✅✅string
metadata.extensions[].version✅✅✅string
metadata.logged_time✅❌❌timestamp
metadata.logged_time_dt✅❌❌string
metadata.original_event_uid✅✅✅string
metadata.product.name✅✅✅string
metadata.product.vendor_name✅✅✅string
metadata.profiles[]✅✅✅string
metadata.uid✅❌❌string
metadata.version✅✅✅string
observables[].name❌✅✅string
observables[].type❌✅✅string
observables[].type_id❌✅✅number
observables[].value❌✅✅string
policy.type❌✅❌string
policy.uid❌✅❌string
severity✅✅✅string
severity_id✅✅✅number
src_endpoint.ip✅❌✅string
status✅❌❌string
status_detail❌❌✅string
status_id✅❌❌number
time✅✅✅number
time_dt✅✅✅string
timezone_offset✅✅✅number
to[]✅✅✅string
type_name✅✅✅string
type_uid✅✅✅number

query_threats

FieldIronscalesMicrosoft DefenderMimecast Cloud GatewayType
action❌✅✅string
action_id❌✅✅number
activity_id✅✅✅number
activity_name✅✅✅string
category_name✅✅✅string
category_uid✅✅✅number
class_name✅✅✅string
class_uid✅✅✅number
disposition❌✅✅string
disposition_id❌✅✅number
evidences[].email.attachment_count✅✅❌number
evidences[].email.from✅✅✅string
evidences[].email.message_uid❌✅❌string
evidences[].email.return_path❌✅❌string
evidences[].email.size❌✅❌number
evidences[].email.subject✅✅✅string
evidences[].email.to[]✅✅❌string
evidences[].email.uid❌✅❌string
evidences[].email.url_count✅✅❌number
finding_info.created_time✅❌❌timestamp
finding_info.created_time_dt✅❌❌string
finding_info.last_seen_time✅❌❌timestamp
finding_info.last_seen_time_dt✅❌❌string
finding_info.uid✅✅✅string
metadata.extensions[].name✅✅✅string
metadata.extensions[].uid✅✅✅string
metadata.extensions[].version✅✅✅string
metadata.product.name✅✅✅string
metadata.product.vendor_name✅✅✅string
metadata.profiles[]✅✅✅string
metadata.version✅✅✅string
observables[].name✅✅❌string
observables[].type✅✅❌string
observables[].type_id✅✅❌number
observables[].value✅✅❌string
policy.type❌✅❌string
policy.uid❌✅❌string
severity✅✅✅string
severity_id✅✅✅number
time✅✅✅number
time_dt✅✅✅string
timezone_offset✅✅✅number
type_name✅✅✅string
type_uid✅✅✅number
Previous page
Next page