Email and Collaboration activity data sources

actResult

-

The action result

Collaboration Sensor

actionName

-

The user or service action

Collaboration Sensor

applicationId

-

The application ID

Collaboration Sensor

attachmentFileHashSha256s

FileSHA2

The secure hash algorithm 256-bit (SHA-256) hash of the email attachment

attachmentFileHashes

FileSHA1

The SHA-1 hash of the email attachment

attachmentFileName

FileName

The file name of the email attachment

attachmentFileTlshes

-

The Trend Micro locality sensitive hashing (TLSH) hash detected by Trend Micro Anti-Spam Engine

-

attachmentMd5

FileMD5

The message-digest algorithm 5 (MD5) hash of the email attachment

attachmentSha1

FileSHA1

The SHA-1 hash of the email attachment

attachmentSha256

FileSHA2

The SHA-256 hash of the email attachment

attachmentSize

-

The attachment file size

-

attachmentSource

-

The attachment source

attachmentTlsh

-

The TLSH hash detected by Trend Micro Anti-Spam Engine

attachmentUrls

-

The uniform resource locators (URLs) and URL sources extracted from the email attachment

-

clientIp

The client internet protocol (IP)

Collaboration Sensor

cloudStorageId

-

The file or folder location ID

Collaboration Sensor

cloudStorageName

-

The file or folder URL

Collaboration Sensor

correlationId

-

The correlation ID

Collaboration Sensor

eventId

-

The event ID

eventName

-

The event type

Collaboration Sensor

eventSubName

-

The event type sub-name

Collaboration Sensor

eventTime

-

The time the agent detected the event

extraInfo

-

The additional information about the sharing action

Collaboration Sensor

fileExt

-

The file extension (If the object is a folder, this field has no value.)

Collaboration Sensor

fileName

FileName

The file or folder name

Collaboration Sensor

filterRiskLevel

-

The top-level risk level of the event

Security Analytics Engine

isExternalAccess

-

Whether an external user ran the cmdlet (True=external user, False=internal user in your organization)

Collaboration Sensor

isSensitiveInfo

-

Whether the event contains sensitive information

Collaboration Sensor

logReceivedTime

-

The time when the extended detection and response (XDR) log was received

Security Analytics Engine

mExternalUid

-

The unique ID of the email

mailAttachmentHash

FileMD5

The hash value of the email attachment

mailBccAddresses

EmailRecipient

The blind carbon copy (BCC) address in the email header

mailCacheId

-

The internal email cache ID to identify emails in the same group

mailCcAddresses

EmailRecipient

The carbon copy (CC) address in the email header

mailDirection

-

The email traffic direction

mailEurekaRuleIds

-

The list of rule IDs scanned by Eureka and detected by Trend Micro Anti-Spam Engine

mailFeatureId

-

The email protocol detected by Trend Micro Anti-Spam Engine

-

mailFolder

-

The email folder name

mailFromAddresses

EmailSender

The From address in the email header

mailHeaderHash

-

The email header hash detected by Trend Micro Anti-Spam Engine

mailHelo

-

The HELO command detected by Trend Micro Anti-Spam Engine

mailMetaText

-

The postman meta text detected by Trend Micro Anti-Spam Engine

mailMetaTraceId

-

The trace ID generated by Trend Micro Feedback Engine

mailMsgId

EmailMessageID

The email ID

mailMsgSubject

EmailSubject

The email subject

mailReplyToAddresses

-

The Reply To address detected by Trend Micro Anti-Spam Engine

mailRuleId

-

The rule ID of the matched rule detected by Trend Micro Anti-Spam Engine

mailScore

-

The score assigned to the email by Trend Micro Anti-Spam Engine

-

mailSenderIp

-

The email sender IP address

mailSmtpFromAddresses

-

The sender email address

mailSmtpOriginalRecipients

-

The original email recipients in the simple mail transfer protocol (SMTP) envelope

mailSmtpRecipients

-

The email recipients in the SMTP envelope after scanning

mailSmtpTls

-

The SMTP transport layer security (TLS) version number

mailSourceDomain

-

The sender email domain

mailTagHash

-

The email tag hash detected by Trend Micro Anti-Spam Engine

mailTagHashRawSignature

-

The raw signature hash of the email

mailTextHash

-

The email text hash detected by Trend Micro Anti-Spam Engine

mailThreatType

-

The type of email detected by Trend Micro Anti-Spam Engine

mailToAddresses

EmailRecipient

The Mail To address in the email header

mailUrlHash

-

The email URL hash detected by Trend Micro Anti-Spam Engine

mailUrlsOriginalLink

-

The original URL extracted from the email content

mailUrlsRealLink

URL

The URL extracted from the email content

mailUrlsVisibleLink

URL

The URL extracted from the email content

mailUserAgent

-

The user agent

mailWantedHeaderName

-

The WantedHeader key name detected by Trend Micro Anti-Spam Engine

mailWantedHeaderValue

-

The WantedHeader key value detected by Trend Micro Anti-Spam Engine

mailWholeHeader

-

The name and email address of the sender in the From header detected by Trend Micro Anti-Spam Engine

mailXMailer

-

The X-Mailer header of the email

mailbox

-

The primary email address

msgUuid

-

The internal email universally unique identifier (UUID) to identify each email message

msgUuidChain

-

The internal UUID chain for each email in Trend Micro Feedback Engine

orgId

-

The organization ID

orgName

-

The tenant name

Collaboration Sensor

originatingServer

-

The server where the operation originated

Collaboration Sensor

parameters

-

The names and values of all parameters used in the cmdlet identified in the Operations property

Collaboration Sensor

pname

-

The internal product code (deprecated)

policyTreePath

-

The policy tree path (endpoint only)

Security Analytics Engine

principalName

UserAccount

The User Principal Name

Collaboration Sensor

productCode

-

The product code of the product that sent the log

Security Analytics Engine

recordType

-

The operation type

Collaboration Sensor

scanTs

-

The time the email was scanned

scanType

-

The manual or real-time scan type

service

-

The Microsoft 365 service where the activity occurred

Collaboration Sensor

tags

-

The detected technique ID based on the alert filter

Security Analytics Engine

target

-

The object accessed by a user or application

Collaboration Sensor

targetType

-

The type of object that was accessed or modified

Collaboration Sensor

userAgent

-

The user agent

Collaboration Sensor

userSessionId

-

The user session ID

Collaboration Sensor

userType

-

The user type

Collaboration Sensor

uuid

-

The unique key of the log entry

Security Analytics Engine