> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-365-emails.md).

# Microsoft 365 Emails

Alerts related to data source "Microsoft 365 Emails".

| Alert                                                                                                                                                                                                                            |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Display text URL differs from actual URL](/analytics-alerts/alerts-by-name/display-text-url-differs-from-actual-url.md)                                                                                                         |
| [Email attachment with a potentially malicious file extension](/analytics-alerts/alerts-by-name/email-attachment-with-a-potentially-malicious-file-extension.md)                                                                 |
| [Email attachment with multiple extensions](/analytics-alerts/alerts-by-name/email-attachment-with-multiple-extensions.md)                                                                                                       |
| [Email attachment with Right-to-Left Override Unicode character](/analytics-alerts/alerts-by-name/email-attachment-with-right-to-left-override-unicode-character.md)                                                             |
| [Email attachment(s) with potentially malicious MIME type](/analytics-alerts/alerts-by-name/email-attachment-s-with-potentially-malicious-mime-type.md)                                                                          |
| [Email containing a link with an IP address convention was detected](/analytics-alerts/alerts-by-name/email-containing-a-link-with-an-ip-address-convention-was-detected.md)                                                     |
| [Email containing a redirected link](/analytics-alerts/alerts-by-name/email-containing-a-redirected-link.md)                                                                                                                     |
| [Email contains URL delivering high-risk file type](/analytics-alerts/alerts-by-name/email-contains-url-delivering-high-risk-file-type.md)                                                                                       |
| [Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values](/analytics-alerts/alerts-by-name/email-marked-as-spam-and-bulk-based-on-spam-confidence-level-and-bulk-complaint-level-values.md) |
| [Email mimics replies or forwards without an actual ongoing conversation](/analytics-alerts/alerts-by-name/email-mimics-replies-or-forwards-without-an-actual-ongoing-conversation.md)                                           |
| [Email sent using an automated system or script detected](/analytics-alerts/alerts-by-name/email-sent-using-an-automated-system-or-script-detected.md)                                                                           |
| [Email was received from an unknown address using a public provider domain](/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-address-using-a-public-provider-domain.md)                                       |
| [Email was received from an unknown sender using a disposable domain](/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-sender-using-a-disposable-domain.md)                                                   |
| [Email with file-sharing link containing auto-download parameter](/analytics-alerts/alerts-by-name/email-with-file-sharing-link-containing-auto-download-parameter.md)                                                           |
| [Email with URL shortener detected](/analytics-alerts/alerts-by-name/email-with-url-shortener-detected.md)                                                                                                                       |
| [External email display name impersonation of internal personnel](/analytics-alerts/alerts-by-name/external-email-display-name-impersonation-of-internal-personnel.md)                                                           |
| [External email with a single internal recipient hidden in BCC](/analytics-alerts/alerts-by-name/external-email-with-a-single-internal-recipient-hidden-in-bcc.md)                                                               |
| [First-seen email from mailbox owner to external recipient's address in the last 30 days](/analytics-alerts/alerts-by-name/first-seen-email-from-mailbox-owner-to-external-recipient-s-address-in-the-last-30-days.md)           |
| [First-time attachment exchange](/analytics-alerts/alerts-by-name/first-time-attachment-exchange.md)                                                                                                                             |
| [Initial person-to-person email contact](/analytics-alerts/alerts-by-name/initial-person-to-person-email-contact.md)                                                                                                             |
| [Moniker link detected in URL(s)](/analytics-alerts/alerts-by-name/moniker-link-detected-in-url-s.md)                                                                                                                            |
| [Near-empty email from an external sender](/analytics-alerts/alerts-by-name/near-empty-email-from-an-external-sender.md)                                                                                                         |
| [Numerous emails sent by a single sender to multiple internal recipients](/analytics-alerts/alerts-by-name/numerous-emails-sent-by-a-single-sender-to-multiple-internal-recipients.md)                                           |
| [Outbound email contains file-sharing service link sent to external recipient](/analytics-alerts/alerts-by-name/outbound-email-contains-file-sharing-service-link-sent-to-external-recipient.md)                                 |
| [Outbound email includes an external BCC recipient observed for the first time](/analytics-alerts/alerts-by-name/outbound-email-includes-an-external-bcc-recipient-observed-for-the-first-time.md)                               |
| [Outbound email to an address hosted by a public email service provider](/analytics-alerts/alerts-by-name/outbound-email-to-an-address-hosted-by-a-public-email-service-provider.md)                                             |
| [Potential Phishing has been detected](/analytics-alerts/alerts-by-name/potential-phishing-has-been-detected.md)                                                                                                                 |
| [Potential spoofing of internal domain spotted](/analytics-alerts/alerts-by-name/potential-spoofing-of-internal-domain-spotted.md)                                                                                               |
| [Punycode characters detected in URL(s)](/analytics-alerts/alerts-by-name/punycode-characters-detected-in-url-s.md)                                                                                                              |
| [Quarantined email released to recipients](/analytics-alerts/alerts-by-name/quarantined-email-released-to-recipients.md)                                                                                                         |
| [Rarely seen sender address in the organization](/analytics-alerts/alerts-by-name/rarely-seen-sender-address-in-the-organization.md)                                                                                             |
| [Rarely seen sender domain in the organization](/analytics-alerts/alerts-by-name/rarely-seen-sender-domain-in-the-organization.md)                                                                                               |
| [Sending unusual file(s) to an external address](/analytics-alerts/alerts-by-name/sending-unusual-file-s-to-an-external-address.md)                                                                                              |
| [Sudden spike in outbound email volume](/analytics-alerts/alerts-by-name/sudden-spike-in-outbound-email-volume.md)                                                                                                               |
| [Suspicious brand affiliation detected](/analytics-alerts/alerts-by-name/suspicious-brand-affiliation-detected.md)                                                                                                               |
| [Suspicious DKIM Result](/analytics-alerts/alerts-by-name/suspicious-dkim-result.md)                                                                                                                                             |
| [Suspicious DMARC result](/analytics-alerts/alerts-by-name/suspicious-dmarc-result.md)                                                                                                                                           |
| [Suspicious sender exhibiting automated sending patterns](/analytics-alerts/alerts-by-name/suspicious-sender-exhibiting-automated-sending-patterns.md)                                                                           |
| [Suspicious sending domain with sender address randomization](/analytics-alerts/alerts-by-name/suspicious-sending-domain-with-sender-address-randomization.md)                                                                   |
| [Suspicious SPF Result](/analytics-alerts/alerts-by-name/suspicious-spf-result.md)                                                                                                                                               |
| [Suspicious theme and sentiment in email](/analytics-alerts/alerts-by-name/suspicious-theme-and-sentiment-in-email.md)                                                                                                           |
| [Suspicious Unicode character detected in email](/analytics-alerts/alerts-by-name/suspicious-unicode-character-detected-in-email.md)                                                                                             |
| [Training simulation email detected](/analytics-alerts/alerts-by-name/training-simulation-email-detected.md)                                                                                                                     |
| [Uncommon URL domain(s) in your organization detected in email](/analytics-alerts/alerts-by-name/uncommon-url-domain-s-in-your-organization-detected-in-email.md)                                                                |
| [Unrecognized internal address (AAD mismatch)](/analytics-alerts/alerts-by-name/unrecognized-internal-address-aad-mismatch.md)                                                                                                   |
| [Unusual attachment volume in outbound emails](/analytics-alerts/alerts-by-name/unusual-attachment-volume-in-outbound-emails.md)                                                                                                 |
| [Unusual display name in From header](/analytics-alerts/alerts-by-name/unusual-display-name-in-from-header.md)                                                                                                                   |
| [Unusual file-sharing links for mailbox owner](/analytics-alerts/alerts-by-name/unusual-file-sharing-links-for-mailbox-owner.md)                                                                                                 |
| [Unusual hostname for the sending mail server in the email headers](/analytics-alerts/alerts-by-name/unusual-hostname-for-the-sending-mail-server-in-the-email-headers.md)                                                       |
| [Unusual sender IP subnet](/analytics-alerts/alerts-by-name/unusual-sender-ip-subnet.md)                                                                                                                                         |
| [Unusual URL(s) sent by a brand were observed in the email](/analytics-alerts/alerts-by-name/unusual-url-s-sent-by-a-brand-were-observed-in-the-email.md)                                                                        |
| [Usage of homograph characters detected in an email](/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email.md)                                                                                     |
| [Usage of homograph characters detected in an email attachment(s) name](/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-attachment-s-name.md)                                                |
| [Usage of homograph characters detected in an email's from header](/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-s-from-header.md)                                                         |
| [Well-known brand in sender headers with header inconsistencies](/analytics-alerts/alerts-by-name/well-known-brand-in-sender-headers-with-header-inconsistencies.md)                                                             |
| [X-Forefront-Antispam-Report has flagged this email as a potential threat](/analytics-alerts/alerts-by-name/x-forefront-antispam-report-has-flagged-this-email-as-a-potential-threat.md)                                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-365-emails.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.