MailPhishing

Proto for all phishing alerts with common payload. Supported types are any of the following:

  • User reported phishing
  • User reported spam spike
  • Suspicious message reported
  • Phishing reclassification
  • Malware reclassification
JSON representation
{
  "domainId": {
    object(DomainId)
  },
  "maliciousEntity": {
    object(MaliciousEntity)
  },
  "messages": [
    {
      object(GmailMessageInfo)
    }
  ],
  "isInternal": boolean
}
Fields
domainId

object(DomainId)

The domain ID.

maliciousEntity

object(MaliciousEntity)

The entity whose actions triggered a Gmail phishing alert.

messages[]

object(GmailMessageInfo)

The list of messages contained by this alert.

isInternal

boolean

If true, the email originated from within the organization.