email-receive

Description

A user received an email message

Parameters

Parameter	Value
Subject	email
Activity	receive
Activity Type	email-receive
Pretty Name	Email Receive

Legacy Names

Success	Fail
dlp-email-alert-in	dlp-email-alert-in-failed

Fields

The possible fields for this activity type will vary depending on whether the activity was a success or a fail.

email-receive:success

Field	Core	Detection	Informational
email_recipients			✓
email_attachment			✓
dest_email_user			✓
dest_user_full_name			✓
dest_user	✓
email_attachments			✓
num_recipients		✓
dest_email_domain			✓
email_address	✓
file_ext			✓
email_user			✓
dest_domain_user_name
bytes		✓
dest_email_address	✓
dest_domain			✓
email_domain			✓
src_email_address	✓
src_email_domain			✓
email_subject			✓
user		✓

email-receive:fail

Field	Core	Detection	Informational
email_recipients			✓
email_attachment			✓
dest_email_user			✓
failure_code		✓
dest_user_full_name			✓
dest_user	✓
failure_reason		✓
email_attachments			✓
num_recipients		✓
dest_email_domain			✓
email_address	✓
file_ext			✓
email_user			✓
dest_domain_user_name
bytes		✓
dest_email_address	✓
dest_domain			✓
email_domain			✓
src_email_address	✓
src_email_domain			✓
email_subject			✓
user		✓