mailClusterEvidence resource type


A group or cluster of emails that is created or identified based on a machine learning or AI model in relation to a malicious email that is reported in the alert as evidence. The mail cluster is suspicious and the emails may be malicious and if so are expected to be remediated.

Inherits from alertEvidence.


Property Type Description
clusterBy String The clustering logic of the emails inside the cluster.
clusterByValue String The value utilized to cluster the similar emails.
emailCount Int64 Count of emails in the email cluster.
networkMessageIds String collection Unique identifiers for the emails in the cluster, generated by Microsoft 365.
query String The query used to identify the email cluster.
urn String Uniform resource name (URN) of the automated investigation where the cluster was identified.



JSON representation

The following is a JSON representation of the resource.

  "@odata.type": "",
  "createdDateTime": "String (timestamp)",
  "verdict": "String",
  "remediationStatus": "String",
  "remediationStatusDetails": "String",
  "roles": [
  "tags": [
  "clusterBy": "String",
  "clusterByValue": "String",
  "query": "String",
  "urn": "String",
  "emailCount": "Integer",
  "networkMessageIds": [