Module email 

Event details relating to an email transaction. This field set focuses on the email message header, body, and attachments. Network protocols that send and receive email messages such as SMTP are outside the scope of the email.* fields.

Constants

EMAIL_ATTACHMENTS

A list of objects describing the attachment files sent along with an email message.

EMAIL_ATTACHMENTS_FILE_EXTENSION

Attachment file extension, excluding the leading dot.

EMAIL_ATTACHMENTS_FILE_HASH_MD5

MD5 hash.

EMAIL_ATTACHMENTS_FILE_HASH_SHA1

SHA1 hash.

EMAIL_ATTACHMENTS_FILE_HASH_SHA256

SHA256 hash.

EMAIL_ATTACHMENTS_FILE_HASH_SHA384

SHA384 hash.

EMAIL_ATTACHMENTS_FILE_HASH_SHA512

SHA512 hash.

EMAIL_ATTACHMENTS_FILE_HASH_SSDEEP

SSDEEP hash.

EMAIL_ATTACHMENTS_FILE_HASH_TLSH

TLSH hash.

EMAIL_ATTACHMENTS_FILE_MIME_TYPE

The MIME media type of the attachment. This value will typically be extracted from the Content-Type MIME header field.

EMAIL_ATTACHMENTS_FILE_NAME

Name of the attachment file including the file extension.

EMAIL_ATTACHMENTS_FILE_SIZE

Attachment file size in bytes.

EMAIL_BCC_ADDRESS

The email address of BCC recipient

EMAIL_CC_ADDRESS

The email address of CC recipient

EMAIL_CONTENT_TYPE

Information about how the message is to be displayed. Typically a MIME type.

EMAIL_DELIVERY_TIMESTAMP

The date and time when the email message was received by the service or client.

EMAIL_DIRECTION

The direction of the message based on the sending and receiving domains.

EMAIL_FROM_ADDRESS

The email address of the sender, typically from the RFC 5322 From: header field.

EMAIL_LOCAL_ID

Unique identifier given to the email by the source that created the event. Identifier is not persistent across hops.

EMAIL_MESSAGE_ID

Identifier from the RFC 5322 Message-ID: email header that refers to a particular email message.

EMAIL_ORIGINATION_TIMESTAMP

The date and time the email message was composed. Many email clients will fill in this value automatically when the message is sent by a user.

EMAIL_REPLY_TO_ADDRESS

The address that replies should be delivered to based on the value in the RFC 5322 Reply-To: header.

EMAIL_SENDER_ADDRESS

Per RFC 5322, specifies the address responsible for the actual transmission of the message.

EMAIL_SUBJECT

A brief summary of the topic of the message.

EMAIL_TO_ADDRESS

The email address of recipient

EMAIL_X_MAILER

The name of the application that was used to draft and send the original email message.