email-send

Description

A user sent an email message

Parameters

Parameter	Value
Subject	email
Activity	send
Activity Type	email-send
Pretty Name	Email Send

Legacy Names

Success	Fail
dlp-email-alert-out	dlp-email-alert-out-failed

Fields

The possible fields for this activity type will vary depending on whether the activity was a success or a fail.

email-send:success

Field	Core	Detection	Informational
dest_email_user			✓
external_domain		✓
dest_email_domain			✓
email_user			✓
attachment		✓
dest_domain_user_name
dest_email_address	✓
src_email_domain			✓
email_recipients			✓
email_attachment			✓
dest_user_full_name			✓
file_name		✓
dest_user	✓
email_attachments			✓
num_recipients		✓
email_address	✓
file_ext		✓	✓
bytes		✓
dest_ip		✓
dest_domain			✓
email_domain			✓
src_email_address	✓
email_subject		✓	✓
user		✓
attachment_count			✓
stripped_email_subject		✓

email-send:fail

Field	Core	Detection	Informational
dest_email_user			✓
external_domain		✓
dest_email_domain			✓
email_user			✓
attachment		✓
dest_domain_user_name
dest_email_address	✓
src_email_domain			✓
email_recipients			✓
email_attachment			✓
failure_code		✓
dest_user_full_name			✓
file_name		✓
dest_user	✓
failure_reason		✓
email_attachments			✓
num_recipients		✓
email_address	✓
file_ext		✓	✓
bytes		✓
dest_ip		✓
dest_domain			✓
email_domain			✓
src_email_address	✓
email_subject		✓	✓
user		✓
attachment_count			✓
stripped_email_subject		✓