Email Security Alerts
The descriptions below detail the fields available for email_security_alerts.
Type: string
The canonical ID for an Email Security Alert (for example, '4WtWkr6nlBz9sNH-2024-08-28T15:32:35').
Type: array[string]
Human-readable list of findings which contributed to this message's final disposition.
Type: array[object]
List of objects containing metadata of attachments contained in this message (for example, [{"Md5": "91f073bd208689ddbd248e8989ecae90", "Sha1": "62b77e14e2c43049c45b5725018e78d0f9986930", "Sha256": "3b57505305e7162141fd898ed87d08f92fc42579b5047495859e56b3275a6c06", "Ssdeep": "McAQ8tPlH25e85Q2OiYpD08NvHmjJ97UfPMO47sekO:uN9M553OiiN/OJ9MM+e3", "Name": "attachment.gif", "ContentTypeProvided": "image/gif", "ContentTypeComputed": "application/x-msi", "Encrypted": true, "Decrypted": true]}, ...]).
Type: array[string]
Email address portions of the CC header provided by the sender (for example, 'firstlast@cloudflare.com').
Type: array[string]
Email address portions of the CC header provided by the sender (for example, 'First Last').
Type: string
Final disposition attributed to the message.
Possible values are unset | malicious | suspicious | spoof | spam | bulk.
Type: string
Email address portion of the From header provided by the sender (for example, 'firstlast@cloudflare.com').
Type: string
Name portion of the From header provided by the sender (for example, 'First Last').
Type: array[string]
List of links detected in this message, benign or otherwise; limited to 100 in total.
Type: string
The message's mode of transport to Email Security.
Possible values are unset | api | direct | bcc | journal | retroScan.
Type: string
Value of the Message-ID header provided by the sender.
Type: string
The origin of the message.
Possible values are unset | internal | external | secondPartyInternal | thirdPartyInternal | outbound.
Type: string
The original sender address as determined by Email Security mail processing (for example, 'firstlast@cloudflare.com').
Type: string
Email address portion of the Reply-To header provided by the sender (for example, 'firstlast@cloudflare.com').
Type: string
Name portion of the Reply-To header provided by the sender (for example, 'First Last').
Type: string
Value of the SMTP MAIL FROM command provided by the sender (for example, 'First Last firstlast@cloudflare.com').
Type: array[string]
Values of the SMTP RCPT TO command provided by the sender (for example, 'First Last firstlast@cloudflare.com').
Type: string
IPv4/v6 of the SMTP HELO server.
Type: string
Autonomous System Name of the SMTP HELO server's IP.
Type: string
Autonomous System Number of the SMTP HELO server's IP.
Type: string
SMTP HELO server geolocation info (for example, 'US/NV/Las Vegas').
Type: string
Hostname provided by the SMTP HELO server.
Type: string
Value of the Subject header provided by the sender.
Type: array[string]
Threat categories attributed by Email Security processing (for example, 'CredentialHarvester', 'Dropper').
Type: int or string
Start time of message processing (for example, '2024-08-28T15:32:35Z'). To specify the timestamp format, refer to Output types.
Type: array[string]
Email address portions of the To header provided by the sender (for example, 'firstlast@cloudflare.com').
Type: array[string]
Name portions of the To header provided by the sender (for example, 'First Last').