> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-overview.md).

# Cortex Advanced Email Security module overview

{% hint style="warning" %}

### Prerequisite

The following are prerequisites for using the Cortex XDR Advanced Email Security module.
{% endhint %}

| Requirement           | Description                                                                              |
| --------------------- | ---------------------------------------------------------------------------------------- |
| Setup and Permissions | Ensure Analytics is activated before enabling the Cortex Advanced Email Security module. |
| Licenses and Add-ons  | Cortex Advanced Email Security add-on.                                                   |

The Cortex Advanced Email Security module provides a scalable detection, investigation, and response layer over cloud-hosted email environments. It connects directly to supported email platforms via secure API integrations to ingest rich message-level and identity-related telemetry.

Unlike legacy approaches that rely on inline enforcement, this module operates passively, requiring no mail flow changes, and is optimized for modern, distributed email infrastructures. After the module is connected, it continuously collects data across messages, artifacts (e.g., links, attachments), user identities, and authentication metadata. This data is processed through a multi-layered analysis engine designed to surface early-stage threats, campaign patterns, and high-risk behaviors.

This document provides detailed technical guidance for onboarding, configuring, and operating the module. It is intended for security administrators and operators with access to email platform APIs, and familiarity with foundational email security concepts for example, SPF/DKIM/DMARC, MIME structure, phishing tactics.

<details>

<summary>Key capabilities and functional highlights</summary>

The Cortex Advanced Email Security module is composed of the following core components:

</details>

<details>

<summary>Supported email platforms and services</summary>

The module supports cloud-native email platforms that expose secure APIs for mailbox telemetry, user directory access, and optional remediation actions.

**Supported integration capabilities include:**

* Read-access to user mailboxes
* Header and authentication metadata
* Access to reported phishing addresses
* Mailbox/user scoping via directory service
* Remediation permissions (delete, move, tag)

**Unsupported environments:**

* On-premise Exchange or SMTP-only deployments
* Hybrid email architectures with incomplete API visibility
* IMAP/POP-based collection (protocol-only)

For detailed setup instructions and platform-specific capabilities, refer to the Deployment and Configuration section.

</details>

<details>

<summary>Supported regions</summary>

The module is available in the following regions:

* Australia (AU)
* Canada (CA)
* France (FA)
* Germany (DE)
* India (IN)
* Japan (JP)
* Netherlands
* Singapore (SG)
* South Korea (KR)
* United Kingdom (UK)
* United States (US)

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/cortex-advanced-email-security-module-overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.