Email events are at the mail server level.


Action Description
block The event corresponding to an email being blcoked by the email server.
delete The event corresponding to an email being deleted.
deliver The event corresponding to an email being sent to an end recipient.
redirect The event corresponding to an email being redirected.
quarantine The event corresponding to an email being qurantined for security reasons.


Field Description Example
action_reason The rationale given for blocking, redirecting, or quarantining an email. Malformed Message
attachment_mime_type The MIME type of the attachment. .docx
attachment_name Filename of any email attachment that may exist. cuddly-cats.pdf
attachment_size Filesize of the attachment. 567 Kb
date SMTP date header, which is actually a date time group. Thu Jul 18 09:30:00 PDT 2019
dest_address Recipient email address, taken from the SMTP “Recipient” field.
dest_ip The destination IP address for the email.
dest_port The destination port for the email. 993
from Displayed sender name from the Message Information header; can be easily forged.
message_body Content of the email, not including subject. Hello World
message_links URLs extracted from the email body.
message_type Content protocol of the message body html
return_address Email address to which replies should be sent, also known as Return-Path or Reply-To; may differ from the src_address.
server_relay The Received portion of the SMTP header, which provides the chain of hosts that the email passed through during delivery; each link usually contains an IP address, domain, and datetime group.  
smtp_uid Distinct ID used to distingquish emails.
src_address Email address of the sender, taken from the “Sender” SMTP field.
src_domain The domain portion of the src_address.
src_ip Originating IP address.
src_port Originating port. 1248
subject Subject line of the email. Lo0k Younger Whl1e L0slng We19ht!!
to The content of the To field in the email header; does not necessarily match up with real recipients.

Coverage Map

  action_reason attachment_mime_type attachment_name attachment_size date dest_address dest_ip dest_port from message_body message_links message_type return_address server_relay smtp_uid src_address src_domain src_ip src_port subject to