Edit

Share via

mailClusterEvidence resource type

  • Article

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

A group or cluster of emails that is created or identified based on a machine learning or AI model in relation to a malicious email that is reported in the alert as evidence. The mail cluster is suspicious and the emails may be malicious and if so are expected to be remediated.

Inherits from alertEvidence.

Properties

Property Type Description
clusterBy String The clustering logic of the emails inside the cluster.
clusterByValue String The value utilized to cluster the similar emails.
emailCount Int64 Count of emails in the email cluster.
networkMessageIds String collection Unique identifiers for the emails in the cluster, generated by Microsoft 365.
query String The query used to identify the email cluster.
urn String Uniform resource name (URN) of the automated investigation where the cluster was identified.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.mailClusterEvidence",
  "createdDateTime": "String (timestamp)",
  "verdict": "String",
  "remediationStatus": "String",
  "remediationStatusDetails": "String",
  "roles": [
    "String"
  ],
  "tags": [
    "String"
  ],
  "clusterBy": "String",
  "clusterByValue": "String",
  "query": "String",
  "urn": "String",
  "emailCount": "Integer",
  "networkMessageIds": [
    "String"
  ]
}