diff --git a/Content/Schema/Information Model Entities/Email Fields.htm b/Content/Schema/Information Model Entities/Email Fields.htm index 91ab89b..e51b9eb 100644 --- a/Content/Schema/Information Model Entities/Email Fields.htm +++ b/Content/Schema/Information Model Entities/Email Fields.htm @@ -13,25 +13,123 @@ Field Name - Example Values - Field Type - Notes + Example Values + Field Type + Notes - email_message_id + email_attachment_file_name + + attachment.exe + array + The file name(s) of an attachment. + + + email_attachment_file_size + + 1024 + long + The size in bytes of the attachments. + + + email_bcc + + stefan@graylog.com + keyword + The email address of BCC recipient/destination. + + + email_cc + + stefan@graylog.com + keyword + The email address of CC recipient/destination. + + + email_delivered_to + + joe@example.com + keyword + The Delivered-To email header field. + + + email_direction + + inbound, outbound, lateral + keyword + Indicates the direction of the observed email flow. Must be either inbound, outbound or lateral, this should be mapped to these values if vendors provide network direction differently. + + + email_from + + stefan@graylog.com + keyword + Per RFC 5322, specifies the address responsible for the actual transmission/sender of the message. + + + email_message_id + + <CAD78=PvAb+iLQ6x+221MGa-22@mail.gmail.com> + keyword + The globally-unique message identifier. + + + email_raw_header   keyword -   + The email authentication header. + + + email_reply_to + + stefan@graylog.com + keyword + The address that replies should be delivered to based on the value in the RFC 5322 Reply-To: header. + + + email_size + + 234 + long + The size of an email in bytes. + + + email_subject + + RE: FWD: Testing + keyword + The email subject. + + + email_to + + stefan@graylog.com + keyword + The email address of recipient/destination. + + + email_uid + + 123456789A + keyword + The email unique identifier internally used by an email software to track a message. + + + email_x_originating_ip + + 192.168.2.3 + array + The X-Originating-IP header identifying the email's originating IP address(es). - email_subject + email_xmailer - RE: FWD: Testing + spambot keyword -   + Tool that created and sent the email.