MailPhishing

Proto for all phishing alerts with common payload. Supported types are any of the following:

  • User reported phishing
  • User reported spam spike
  • Suspicious message reported
  • Phishing reclassification
  • Malware reclassification
  • Gmail potential employee spoofing
JSON representation 
{
  "domainId": {
    object (DomainId)
  },
  "maliciousEntity": {
    object (MaliciousEntity)
  },
  "messages": [
    {
      object (GmailMessageInfo)
    }
  ],
  "isInternal": boolean,
  "systemActionType": enum (SystemActionType)
}
Fields
domainId

object (DomainId)

The domain ID.
maliciousEntity

object (MaliciousEntity)

The entity whose actions triggered a Gmail phishing alert.
messages[]

object (GmailMessageInfo)

The list of messages contained by this alert.
isInternal

boolean

If true, the email originated from within the organization.
systemActionType

enum (SystemActionType)

System actions on the messages.