Email Security Post-Delivery Events
The descriptions below detail the fields available for email_security_post_delivery_events.
Type: string
Email Security alert ID for the original message.
Type: int or string
The timestamp when the post-delivery action completed. To specify the timestamp format, refer to Output types.
Type: string
Target folder for MOVE operations (for example, 'RecoverableItemsPurges').
Type: string
Threat disposition of the original message.
Possible values are unset | none | malicious | suspicious | spam | spoof | bulk.
Type: string
Resolved folder name after a successful MOVE.
Type: string
From header address of the original message (for example, 'firstlast@cloudflare.com').
Type: string
From header display name of the original message (for example, 'First Last').
Type: string
RFC Message-ID header of the original message.
Type: int or string
The timestamp of the original message. To specify the timestamp format, refer to Output types.
Type: string
Microsoft 365 tenant identifier.
Type: string
Post-delivery action type.
Possible values are move | submission | quarantineRelease.
Type: string
Email Security postfix queue identifier for the original message.
Type: array[string]
Detection findings that prompted the post-delivery action (for example, 'Malicious URL').
Type: string
Email address of the targeted mailbox (for example, 'firstlast@cloudflare.com').
Type: int or string
The timestamp when the post-delivery action was requested. To specify the timestamp format, refer to Output types.
Type: string
Identity that requested the post-delivery action; expected format is an email address.
Type: string
Requested disposition for SUBMISSION operations.
Type: string
Status message returned by the post-delivery provider (for example, 'OK').
Type: string
Subject header of the original message.
Type: bool
Whether the post-delivery action succeeded.
Type: array[string]
Recipient addresses of the original message (for example, 'firstlast@cloudflare.com').