action_idsstring[]
IDs of actions to run when the rule is triggered
activeboolean
Indicates whether or not the rule is active and will flag matching messages
auto_review_auto_shareboolean
Whether auto-reviewed messages will be shared
auto_review_classification'malicious' | 'benign' | 'spam' | 'graymail' | 'simulation' | 'unwanted' | 'violation' | 'non-violation'
The classification auto-reviewed messages will have, when an auto-review action is associated with the rule
created_atstring date-time
descriptionstring required
detection_methodsstring[]
Rule detection technologies
false_positivesstring[]
Descriptions of known false positives that could occur
last_activated_atstring date-time
When the rule was last activated
passiveboolean
Indicates whether or not the rule is in passive mode
referencesstring[]
URLs of reference resources for this rule
run_triage_on_excluded_messagesboolean
For Triage rules only, whether this rule will run even if the message matched a global exclusion.
severity'informational' | 'low' | 'medium' | 'high' | 'critical'
sourcestring required
Rule MQL (Message Query Language) source
tactics_and_techniquesstring[]
Rule tactics and techniques
tagsstring[]
Freeform tags for this rule (for example, "Executive Impersonation")
triage_abuse_reportsboolean
For Triage rules only, whether this rule will run for reported messages. For triage rules, one triage_ field must be true.
triage_classification_changesboolean
For Triage rules only, whether this rule will run for messages whose classification has just changed. For triage rules, one triage_ field must be true.
triage_delivery_blockedboolean
For Triage rules only, whether this rule will run for messages that had delivery blocked. For triage rules, one triage_ field must be true.
triage_dlp_rule_matchedboolean
For Triage rules only, whether this rule will run for messages that matched a DLP rule. For triage rules, one triage_ field must be true.
triage_flagged_messagesboolean
For Triage rules only, whether this rule will run for messages which flagged. For triage rules, one triage_ field must be true.
updated_atstring date-time