email_security.security_event.created

{
  "data": {
    "payload": {
      "adaptive_url": "https://admin.adaptivesecurity.com/email-security/security-events/a8f2947c-3aef-4f5a-981f-08be76fde32f",
      "analysis": {
        "attack_tactics": [
          "vendor_impersonation",
          "credential_harvesting"
        ],
        "attack_type": "CREDENTIAL_PHISHING",
        "confidence": 97,
        "explanation": {
          "reasons": [
            {
              "detail": "The billing verification link leads to a domain unrelated to the sender.",
              "evidence": [
                {
                  "label": "Link target",
                  "value": "https://billing-verify.example.net/login"
                }
              ],
              "headline": "Credential-harvesting link"
            }
          ],
          "summary": "A fraudulent billing notice asks the recipient to sign in on a domain unrelated to the vendor."
        }
      },
      "auto_remediation_action": "QUARANTINE",
      "classification": "MALICIOUS",
      "created": "2026-09-15T22:19:04.212168Z",
      "delivery": {
        "category": "INBOX",
        "direction": "INBOUND",
        "message_location": "ORIGINAL_DELIVERY_LOCATION"
      },
      "id": "a8f2947c-3aef-4f5a-981f-08be76fde32f",
      "integration": {
        "display_name": "Acme Google Workspace",
        "id": "72f66c91-6aec-4561-9395-3b5b7d3b2b70",
        "provider": "GOOGLE"
      },
      "message": {
        "all_recipients": [
          "jordan.lee@example.com",
          "finance@example.com"
        ],
        "attachments": [
          {
            "content_type": "application/pdf",
            "file_extension": "pdf",
            "name": "invoice.pdf",
            "scan_result": "SAFE",
            "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
            "size_bytes": 24576
          }
        ],
        "headers": [
          {
            "name": "Received",
            "value": "from mail.vendor.example.com (mail.vendor.example.com [203.0.113.50])"
          }
        ],
        "links": [
          {
            "display_text": "Verify your billing account",
            "source": "EMAIL_BODY",
            "type": "HYPERLINK",
            "url": "https://billing-verify.example.net/login"
          }
        ],
        "message_timestamp": "2026-09-15T22:15:25Z",
        "recipient": "jordan.lee@example.com",
        "rfc_2392_message_id": "<CAF1x2y3z4@mail.vendor.example.com>",
        "sender": "billing@vendor.example.com",
        "subject": "Action required: verify your billing account"
      },
      "review_status": "RESOLVED",
      "source": "DETECTION"
    }
  },
  "datacontenttype": "application/json",
  "id": "9b2f6c1e-8d3a-4f0b-a1c2-5e7d9f3b6a48",
  "source": "/adaptive",
  "specversion": "1.0",
  "time": "2026-06-09T18:00:00Z",
  "type": "email_security.security_event.created"
}