security-mailclusterevidence.md

title	description	ms.date	author	ms.localizationpriority	ms.subservice	doc_type
mailClusterEvidence resource type	A mail cluster that is reported in the alert as evidence.	09/09/2021	BenAlfasi	medium	security	resourcePageType

mailClusterEvidence resource type

Namespace: microsoft.graph.security

[!INCLUDE beta-disclaimer]

A group or cluster of emails that is created or identified based on a machine learning or AI model in relation to a malicious email that is reported in the alert as evidence. The mail cluster is suspicious and the emails may be malicious and if so are expected to be remediated.

Inherits from alertEvidence.

Properties

Property	Type	Description
clusterBy	String	The clustering logic of the emails inside the cluster.
clusterByValue	String	The value utilized to cluster the similar emails.
emailCount	Int64	Count of emails in the email cluster.
networkMessageIds	String collection	Unique identifiers for the emails in the cluster, generated by Microsoft 365.
query	String	The query used to identify the email cluster.
urn	String	Uniform resource name (URN) of the automated investigation where the cluster was identified.

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.mailClusterEvidence",
  "createdDateTime": "String (timestamp)",
  "verdict": "String",
  "remediationStatus": "String",
  "remediationStatusDetails": "String",
  "roles": [
    "String"
  ],
  "tags": [
    "String"
  ],
  "clusterBy": "String",
  "clusterByValue": "String",
  "query": "String",
  "urn": "String",
  "emailCount": "Integer",
  "networkMessageIds": [
    "String"
  ]
}