A user sent an email message
| Parameter |
Value |
| Subject |
email |
| Activity |
send |
| Activity Type |
email-send |
| Pretty Name |
Email Send |
| Success |
Fail |
dlp-email-alert-out
|
dlp-email-alert-out-failed
|
The possible fields for this activity type will vary depending on whether the activity was a success or a fail.
| Field |
Core |
Detection |
Informational |
| dest_email_user |
|
|
✓ |
| external_domain |
|
✓ |
|
| dest_email_domain |
|
|
✓ |
| email_user |
|
|
✓ |
| attachment |
|
✓ |
|
| dest_domain_user_name |
|
|
|
| dest_email_address |
✓ |
|
|
| src_email_domain |
|
|
✓ |
| email_recipients |
|
|
✓ |
| email_attachment |
|
|
✓ |
| dest_user_full_name |
|
|
✓ |
| file_name |
|
✓ |
|
| dest_user |
✓ |
|
|
| email_attachments |
|
|
✓ |
| num_recipients |
|
✓ |
|
| email_address |
✓ |
|
|
| file_ext |
|
✓ |
✓ |
| bytes |
|
✓ |
|
| dest_ip |
|
✓ |
|
| dest_domain |
|
|
✓ |
| email_domain |
|
|
✓ |
| src_email_address |
✓ |
|
|
| email_subject |
|
✓ |
✓ |
| user |
|
✓ |
|
| attachment_count |
|
|
✓ |
| stripped_email_subject |
|
✓ |
|
| Field |
Core |
Detection |
Informational |
| dest_email_user |
|
|
✓ |
| external_domain |
|
✓ |
|
| dest_email_domain |
|
|
✓ |
| email_user |
|
|
✓ |
| attachment |
|
✓ |
|
| dest_domain_user_name |
|
|
|
| dest_email_address |
✓ |
|
|
| src_email_domain |
|
|
✓ |
| email_recipients |
|
|
✓ |
| email_attachment |
|
|
✓ |
| failure_code |
|
✓ |
|
| dest_user_full_name |
|
|
✓ |
| file_name |
|
✓ |
|
| dest_user |
✓ |
|
|
| failure_reason |
|
✓ |
|
| email_attachments |
|
|
✓ |
| num_recipients |
|
✓ |
|
| email_address |
✓ |
|
|
| file_ext |
|
✓ |
✓ |
| bytes |
|
✓ |
|
| dest_ip |
|
✓ |
|
| dest_domain |
|
|
✓ |
| email_domain |
|
|
✓ |
| src_email_address |
✓ |
|
|
| email_subject |
|
✓ |
✓ |
| user |
|
✓ |
|
| attachment_count |
|
|
✓ |
| stripped_email_subject |
|
✓ |
|