{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "#/components/schemas/microsoft.graph.security.mailClusterEvidence",
  "title": "microsoft.graph.security.mailClusterEvidence",
  "allOf": [
    {
      "$ref": "#/components/schemas/microsoft.graph.security.alertEvidence"
    },
    {
      "title": "mailClusterEvidence",
      "required": [
        "@odata.type"
      ],
      "type": "object",
      "properties": {
        "clusterBy": {
          "type": "string",
          "description": "The clustering logic of the emails inside the cluster.",
          "nullable": true
        },
        "clusterByValue": {
          "type": "string",
          "description": "The value utilized to cluster the similar emails.",
          "nullable": true
        },
        "emailCount": {
          "type": "number",
          "description": "Count of emails in the email cluster.",
          "format": "int64",
          "nullable": true
        },
        "networkMessageIds": {
          "type": "array",
          "items": {
            "type": "string",
            "nullable": true
          },
          "description": "Unique identifiers for the emails in the cluster, generated by Microsoft 365."
        },
        "query": {
          "type": "string",
          "description": "The query used to identify the email cluster.",
          "nullable": true
        },
        "urn": {
          "type": "string",
          "description": "Uniform resource name (URN) of the automated investigation where the cluster was identified.",
          "nullable": true
        },
        "@odata.type": {
          "type": "string",
          "default": "#microsoft.graph.security.mailClusterEvidence"
        }
      }
    }
  ],
  "x-ms-discriminator-value": "#microsoft.graph.security.mailClusterEvidence"
}