ADadaptivesecurity
Email Security

List security events

Changed on

Retrieve Email Security detections, newest first. Each item is a security event without the fields that need a read per event: message attachments, headers and links, similar_security_event_ids, last_remediation_actor, remediation_error and the integration's display_name. Get a security event by its id for those. Filters combine with AND. Spam events are listed only when spam detection is enabled for the company.

Required permission: email_security:read

get/v2/email-security/security-events

Request

  • Base URL
    https://api.adaptivesecurity.com
  • URL
    https://api.adaptivesecurity.com/v2/email-security/security-events
  • Auth
    HTTP bearer

Query parameters

page_afterstring

Page cursor: the page_after value from the previous page

page_sizeinteger

Number of results per page (max 1000)

classificationstring[]

Only events with one of these classifications

[
  "MALICIOUS"
]
review_statusstring[]

Only events in one of these review states

[
  "NEEDS_REVIEW"
]
sourcestring[]

Only events created by one of these sources

[
  "USER_REPORT"
]
start_datestring date-time

Only events created at or after this time (ISO 8601)

end_datestring date-time

Only events created at or before this time (ISO 8601)

Response

Successfully retrieved security events

page_afterstring nullable

Cursor for the next page of results. Null if this is the last page

Example response

{
  "page_after": "a8f2947c-3aef-4f5a-981f-08be76fde32f",
  "security_events": [
    {
      "adaptive_url": "https://admin.adaptivesecurity.com/email-security/security-events/a8f2947c-3aef-4f5a-981f-08be76fde32f",
      "analysis": {
        "attack_tactics": [
          "vendor_impersonation"
        ],
        "attack_type": "CREDENTIAL_PHISHING",
        "classification": "MALICIOUS",
        "confidence": 62,
        "explanation": {
          "reasons": [
            {
              "evidence": [
                {
                  "label": "Body excerpt",
                  "value": "would you like to See What is the price?"
                }
              ],
              "headline": "Conference attendee list sales lure"
            }
          ]
        },
        "same_message_count": 1
      },
      "created": "2026-09-15T22:19:04.212168Z",
      "delivery": {
        "category": "INBOX",
        "direction": "INBOUND",
        "message_location": "QUARANTINE",
        "opened_status": {
          "first_seen_opened_at": "2026-09-15T22:19:05.019434Z",
          "last_checked_at": "2026-09-15T22:19:05.019434Z",
          "poll_status": "DONE"
        }
      },
      "id": "a8f2947c-3aef-4f5a-981f-08be76fde32f",
      "integration": {
        "id": "72f66c91-6aec-4561-9395-3b5b7d3b2b70",
        "provider": "GOOGLE"
      },
      "message": {
        "message_timestamp": "2026-09-15T22:15:25Z",
        "recipient": "recipient@example.com",
        "rfc_2392_message_id": "<CAF1x2y3z4@mail.example.com>",
        "sender": "sender@example.com",
        "subject": "RSVP Required"
      },
      "reports": {
        "count": 1,
        "first_reported_at": "2026-09-15T22:19:04Z",
        "last_reported_at": "2026-09-16T08:02:11Z",
        "reported_by": [
          {
            "method": "PHISH_ALERT_BUTTON",
            "reported_at": "2026-09-15T22:19:04Z",
            "reporter": {
              "email_address": "jordan.lee@example.com",
              "name": "Jordan Lee",
              "user_id": "5d0b6c1e-8f3a-4b7e-9c2d-1a4e6f8b0c3d"
            }
          }
        ]
      },
      "review": {
        "status": "RESOLVED"
      },
      "source": "DETECTION",
      "version": 1
    }
  ]
}

Changes

  • c367e8f673f3Revision changes
    • breaking

      the response property /// became nullable for the status

    • warning

      added the new ADMIN_REPORT enum value to the // response property for the response status

    • info

      added the enum value ADMIN_REPORT to the property items/ of the query request parameter source

    • info

      added the optional property // to the response with the status

  • 415bfaebfcdfRevision changes
    • info

      endpoint added