product = "targeted attack platform"
| Field | Core | Detection | Informational |
|---|---|---|---|
| country | ✓ | ||
| query_id | ✓ | ||
| mime | ✓ | ||
| rule | ✓ | ||
| malware_score | ✓ | ||
| threat_id | ✓ | ||
| alert_type | ✓ | ||
| src_ip | ✓ | ||
| result | ✓ | ||
| protocol | ✓ | ||
| alert_id | ✓ | ||
| hash_md5 | ✓ | ||
| page_count | ✓ | ||
| direction | ✓ | ||
| creator | ✓ | ||
| phishing_score | ✓ | ||
| message_id | ✓ | ||
| num_recipients | ✓ | ||
| hash_sha256 | ✓ | ||
| auth_method | ✓ | ||
| return_path | ✓ | ||
| bytes | ✓ | ||
| dest_ip | ✓ | ||
| is_consolidated | ✓ | ||
| log_source | ✓ | ||
| malware_url | ✓ | ||
| spam_score | ✓ | ||
| category | ✓ | ||
| alert_name | ✓ |
| Activity Type | Field | Status | Core | Detection | Informational |
|---|---|---|---|---|---|
| email-receive | folder_name | Default | ✓ | ||
| email-send |