- email_message_id
- |
+ email_attachment_file_name |
+ attachment.exe |
+ array |
+ The file name(s) of an attachment. |
+
+
+ email_attachment_file_size |
+ 1024 |
+ long |
+ The size in bytes of the attachments. |
+
+
+ email_bcc |
+ stefan@graylog.com |
+ keyword |
+ The email address of BCC recipient/destination. |
+
+
+ email_cc |
+ stefan@graylog.com |
+ keyword |
+ The email address of CC recipient/destination. |
+
+
+ email_delivered_to |
+ joe@example.com |
+ keyword |
+ The Delivered-To email header field. |
+
+
+ email_direction |
+ inbound, outbound, lateral |
+ keyword |
+ Indicates the direction of the observed email flow. Must be either inbound, outbound or lateral, this should be mapped to these values if vendors provide network direction differently. |
+
+
+ email_from |
+ stefan@graylog.com |
+ keyword |
+ Per RFC 5322, specifies the address responsible for the actual transmission/sender of the message. |
+
+
+ email_message_id |
+ <CAD78=PvAb+iLQ6x+221MGa-22@mail.gmail.com> |
+ keyword |
+ The globally-unique message identifier. |
+
+
+ email_raw_header |
|
keyword |
- |
+ The email authentication header. |
+
+
+ email_reply_to |
+ stefan@graylog.com |
+ keyword |
+ The address that replies should be delivered to based on the value in the RFC 5322 Reply-To: header. |
+
+
+ email_size |
+ 234 |
+ long |
+ The size of an email in bytes. |
+ email_to |
+ stefan@graylog.com |
+ keyword |
+ The email address of recipient/destination. |
+
+
+ email_uid |
+ 123456789A |
+ keyword |
+ The email unique identifier internally used by an email software to track a message. |
+
+
+ email_x_originating_ip |
+ 192.168.2.3 |
+ array |
+ The X-Originating-IP header identifying the email's originating IP address(es). |
+
+
+ email_xmailer |
+ spambot |
+ keyword |
+ Tool that created and sent the email. |