Email schema

Use this reference to identify the fields available in the email schema and the parser fields used to populate them.

For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.

Schema summary

Property	Value
Schema name	Email
Parser field prefix	Email
Supports custom parsers	Yes
Schema components	AttachmentRecord, ThreatRecord, Direction, Status

Schema components

AttachmentRecord

Normalized Field	Type	Parser Field	Description
file_name	string	fileName$	Filename of the attachment.
file_hash	FileHash	fileHash$	File hashes associated with the attachment.
file_size	uint64	fileSize$	Size of the attachment.
declared_content_type	string	declaredContentType$	Content type according to the email.
detected_content_type	string	detectedContentType$	Content type as determined by analysis, which may be of interest when different from declared type.
sandbox_status	string	sandboxStatus$	Status of the attachment, such as "THREAT".

ThreatRecord

Record of threat that was detected in email attachment.

Normalized Field	Type	Parser Field	Description
fileinfo	AttachmentRecord	fileinfo$	General file information.
classification	string	classification$	Threat specific.
name	string	name$	Threat name.
vendor_threat_url	string	vendorThreatUrl$	URL provided by the vendor in the event with more information.
type	string	type$	Threat type.
additional_threat_data	KeyValuePairsIndexed	additionalThreatData$	Additional metadata of the threat data in key-value pairs.

Email.Direction

Name	Number	Description
UNKNOWN	0	Unused but required for Proto3.
INBOUND	1	Inbound email.
OUTBOUND	2	Outbound email.
INTERNAL	3	Internal email that does not cross the boundary to the public internet.

Email.Status

Types of delivery statuses.

Name	Number	Description
UNKNOWN_STATUS	0	Unused but required for Proto3.
DELIVERED	1	Delivered/accepted.
QUARANTINED	2	Quarantined/held.
BLOCKED	3	Blocked outright.

Schema fields

Normalized Field	Type	Parser Field	Description
resource_id	string	resourceId$	Full resource string identifying the record.
tenant_id	string	tenantId$	ID of the tenant.
sensor_type	string	sensorType$	Type of device that generated this event.
sensor_event_id	string	sensorEventId$	Event ID of `original_data` assigned by the sensor.
sensor_tenant	string	sensorTenant$	A customer ID supplied by the application that originated the data.
sensor_id	string	sensorId$	An ID for the data supplied by the application that originated it.
sensor_cpe	string	sensorCpe$	CPE of the platform producing the alert.
original_data	string	originalData$	Original, unadulterated data prior to any transformation.
event_time_usec	uint64	eventTimeUsec$	Event time in microseconds (µs).
ingest_time_usec	uint64	ingestTimeUsec$	Ingest time in microseconds (µs).
event_time_fidelity	TimeFidelity	eventTimeFidelity$	Specifies the original precision of the time used to populate `event_time_usec`.
host_id	string	hostId$	The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address.
sensor_version	string	sensorVersion$	The agent version as string.
from_email_address	repeated string	fromEmailAddress$	Source email addresses, which may be of interest if multiple are specified.
to_email_address	repeated string	toEmailAddress$	To email addresses.
cc_email_address	repeated string	ccEmailAddress$	CC email addresses.
bcc_email_address	repeated string	bccEmailAddress$	BCC email addresses.
reply_to_email_address	string	replyToEmailAddress$	Email address to reply to.
subject	string	subject$	Subject.
message_size	uint64	messageSize$	Message size in bytes.
status	Email.Status	status$	Delivery status.
direction	Email.Direction	direction$	Email direction.
attachments	AttachmentRecord	repeated	List of attachments and hashes in the email.
vendor_spam_score	int32	vendorSpamScore$	Spam score provided by the vendor that provides level of confidence in if it's spam or not.
quarantine_reason	string	quarantineReason$	Reason for being quarantined, such as Virus or Malware.
threats	ThreatRecord	repeated	All recorded threats detected.
sender_ip	string	senderIp$	IP that sent the email.
vendor_alert_url	string	vendorAlertUrl$	Documentation provided by the vendor about the overall alert.
message_id	string	messageId$	Vendor-assigned ID of the email message. Note this may not be unique because several email events can be generated for a single email.
click_time_usec	uint64	clickTimeUsec$	Time the user clicked on the URL.
event_type	string	eventType$	The event type provided by the email security source, such as 'Click Permitted'.
event_metadata	KeyValuePairsIndexed	eventMetadata$	`event_metadata` provided by the data source to add context.

Fields under vendor_alert_details on the email record:

Normalized Field	Type	Parser Field	Description
vendor_alert_details.is_custom_alert	NullableBoolean	`vendorAlertDetails$.isCustomAlert$`	True when the detection reflects customer or tenant logic: wholly custom rules or indicators, or vendor-supplied templates, content packs, or building blocks that the tenant instantiated or materially configured (for example, policies, named rule instances, thresholds, or scope). False when the alert is produced solely by vendor-default, uniformly deployed detection without meaningful per-tenant logic. Unknown when provenance cannot be determined from the source.

Note

When is_custom_alert is true:

Detection severity is not altered.
These detections are sent directly to the tenant for self-service and don't enter the MDR service queue because they are outside the scope of the Sophos MDR service. For details on MDR, see MDR.