analyzedMessageEvidence resource type

  • Articolo

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

An email, or analyzed message, that is reported in the alert as evidence.

Inherits from alertEvidence.

Properties

Property Type Description
antiSpamDirection String Direction of the email relative to your network. The possible values are: inbound, outbound or intraorg.
attachmentsCount Int64 Number of attachments in the email.
deliveryAction String Delivery action of the email. The possible values are: delivered, deliveredAsSpam, junked, blocked, or replaced.
deliveryLocation String Location where the email was delivered. The possible values are: inbox, external, junkFolder, quarantine, failed, dropped, deletedFolder or forwarded.
internetMessageId String Public-facing identifier for the email that is set by the sending email system.
language String Detected language of the email content.
networkMessageId String Unique identifier for the email, generated by Microsoft 365.
p1Sender microsoft.graph.security.emailSender The P1 sender.
p2Sender microsoft.graph.security.emailSender The P2 sender.
receivedDateTime DateTimeOffset Date and time when the email was received.
recipientEmailAddress String Email address of the recipient, or email address of the recipient after distribution list expansion.
senderIp String IP address of the last detected mail server that relayed the message.
subject String Subject of the email.
threatDetectionMethods String collection Collection of methods used to detect malware, phishing, or other threats found in the email.
threats String collection Collection of detection names for malware or other threats found.
urlCount Int64 Number of embedded URLs in the email.
urls String collection Collection of the URLs contained in this email.
urn String Uniform resource name (URN) of the automated investigation where the cluster was identified.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.analyzedMessageEvidence",
  "createdDateTime": "String (timestamp)",
  "verdict": "String",
  "remediationStatus": "String",
  "remediationStatusDetails": "String",
  "roles": [
    "String"
  ],
  "tags": [
    "String"
  ],
  "networkMessageId": "String",
  "internetMessageId": "String",
  "subject": "String",
  "language": "String",
  "senderIp": "String",
  "recipientEmailAddress": "String",
  "antiSpamDirection": "String",
  "deliveryAction": "String",
  "deliveryLocation": "String",
  "urn": "String",
  "threats": [
    "String"
  ],
  "threatDetectionMethods": [
    "String"
  ],
  "urls": [
    "String"
  ],
  "urlCount": "Integer",
  "attachmentsCount": "Integer",
  "receivedDateTime": "String (timestamp)",
  "p1Sender": {
    "@odata.type": "microsoft.graph.security.emailSender"
  },
  "p2Sender": {
    "@odata.type": "microsoft.graph.security.emailSender"
  }
}