{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "#/components/schemas/email-security_MailsearchMessage",
  "title": "email-security_MailsearchMessage",
  "allOf": [
    {
      "properties": {
        "action_log": {},
        "alert_id": {
          "nullable": true,
          "type": "string"
        },
        "client_recipients": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "delivery_mode": {
          "allOf": [
            {
              "$ref": "#/components/schemas/email-security_MessageDeliveryMode"
            },
            {
              "nullable": true,
              "type": "string"
            }
          ]
        },
        "detection_reasons": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "edf_hash": {
          "nullable": true,
          "type": "string"
        },
        "final_disposition": {
          "allOf": [
            {
              "$ref": "#/components/schemas/email-security_DispositionLabel"
            },
            {
              "nullable": true,
              "type": "string"
            }
          ]
        },
        "from": {
          "nullable": true,
          "type": "string"
        },
        "from_name": {
          "nullable": true,
          "type": "string"
        },
        "is_phish_submission": {
          "type": "boolean"
        },
        "is_quarantined": {
          "type": "boolean"
        },
        "message_id": {
          "type": "string"
        },
        "postfix_id": {
          "$ref": "#/components/schemas/email-security_PostfixId"
        },
        "sent_date": {
          "nullable": true,
          "type": "string"
        },
        "subject": {
          "nullable": true,
          "type": "string"
        },
        "threat_categories": {
          "items": {
            "type": "string"
          },
          "nullable": true,
          "type": "array"
        },
        "to": {
          "items": {
            "type": "string"
          },
          "nullable": true,
          "type": "array"
        },
        "to_name": {
          "items": {
            "type": "string"
          },
          "nullable": true,
          "type": "array"
        },
        "ts": {
          "type": "string"
        },
        "validation": {
          "allOf": [
            {
              "properties": {
                "comment": {
                  "nullable": true,
                  "type": "string"
                },
                "dkim": {
                  "allOf": [
                    {
                      "$ref": "#/components/schemas/email-security_ValidationStatus"
                    },
                    {
                      "nullable": true,
                      "type": "string"
                    }
                  ]
                },
                "dmarc": {
                  "allOf": [
                    {
                      "$ref": "#/components/schemas/email-security_ValidationStatus"
                    },
                    {
                      "nullable": true,
                      "type": "string"
                    }
                  ]
                },
                "spf": {
                  "allOf": [
                    {
                      "$ref": "#/components/schemas/email-security_ValidationStatus"
                    },
                    {
                      "nullable": true,
                      "type": "string"
                    }
                  ]
                }
              },
              "type": "object"
            },
            {
              "nullable": true,
              "type": "object"
            }
          ]
        }
      },
      "required": [
        "ts",
        "message_id",
        "client_recipients",
        "postfix_id",
        "detection_reasons",
        "action_log",
        "is_quarantined",
        "is_phish_submission"
      ],
      "type": "object"
    },
    {
      "properties": {
        "id": {
          "type": "string"
        }
      },
      "required": [
        "id"
      ],
      "type": "object"
    }
  ],
  "example": {
    "action_log": [],
    "alert_id": "4Njp3P0STMz2c02Q-2022-12-30T02:44:49",
    "client_recipients": [
      "email@example.com"
    ],
    "delivery_mode": "DIRECT",
    "detection_reasons": [
      "Selector is a source of spam/uce : Smtp-Helo-Server-Ip=<b>127.0.0[dot]186</b>"
    ],
    "edf_hash": null,
    "final_disposition": "MALICIOUS",
    "from": "d1994@example.com",
    "from_name": "Sender Name",
    "id": "47JJcT1w6GztQV7-email@example.com",
    "is_phish_submission": false,
    "is_quarantined": false,
    "message_id": "<4VAZPrAdg7IGNxdt1DWRNu0gvOeL_iZiwP4BQfo4DaE.Yw-woXuugQbeFhBpzwFQtqq_v2v1HOKznoMBqbciQpE@example.com>",
    "postfix_id": "47JJcT1w6GztQV7",
    "sent_date": "2019-11-21 00:22:01",
    "subject": "listen, I highly recommend u to read that email, just to ensure not a thing will take place",
    "threat_categories": [
      "IPReputation",
      "ASNReputation"
    ],
    "to": [
      "email@example.com"
    ],
    "to_name": [
      "Recipient Name"
    ],
    "ts": "2019-11-20 23:22:01",
    "validation": {
      "comment": null,
      "dkim": "pass",
      "dmarc": "none",
      "spf": "fail"
    }
  }
}