> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/malicious-email-inventory.md). # Malicious Email Inventory {% hint style="info" %} ### Notice Requires the Advanced Email Security module. {% endhint %} Simplify your email threat triage with the Malicious Emails Inventory. Designed specifically for malicious email analysis, this dedicated view provides immediate context on which emails were suspicious and why emails were flagged, enabling you to view and act on malicious emails from a timeframe you select, and pivot to other views for forensic investigations and remediation actions. {% hint style="info" %} Find the inventory under **Modules** → **Email Security** → **Malicious Emails Inventory**. {% endhint %} Use the three widgets at the top of the screen to get an overview of the malicious emails that were detected by the module. If you filter any of the widgets or the table, all the widgets and the table on the page are updated accordingly. *** ### Malicious Email widgets * **Email Verdict Overview**: How many malicious emails were tagged out of all the emails collected. Malicious emails are emails for which at least one issue was created with a severity level of Medium or above. Use the filters for the following cases: * Change the duration to last 24 hours, last 7 days, last 30 days, or a custom duration to update the displayed data according to your preferred time frame. The maximum is 30 days. * Add a filter to update the display in the format: filtered/total malicious/total scanned emails. * **Detection Tags**: Top five detection tags that appear in the displayed emails. Click the widget to get more detailed information in the malicious emails table below. * **Remediation Type**: How many emails have a configured remediation policy. Click the widget to get more detailed information in the malicious emails table below. *** ### Malicious Emails table View the details of the emails tagged as malicious. You can filter the table by any field you're interested in to see the statistics in the table and in the widgets. Available fields are: * **Detected at**: Date and time of detection * **Subject** * **Direction**: Inbound or outbound * **Internet Message ID** * **URLs**: Number of URLs in the email message. * **Attachments**: Number of attachments in the email message. * **Issues Breakdown**: Number of issues generated based on the email and their severities. * **Severity**: Maximum severity of all the issues related to this email. * **Detection tags**: Tags in the issues that are based on this email. * **Rarity**: How rare an email exchange between the sender and recipient is. For emails with multiple recipients, this column reflects the strictest rarity level (the weakest connection) among all sender-recipient pairs. * **Source** * **Remediation Type**: If the email has remediation actions configured. * **Remediation Status**: Which remediation actions were run. * **Case ID** * **Status**: A reflection of the statuses of all the issues based on this email. The status is Resolved only when all the issues based on this email are resolved. Otherwise it stays Open. Click each row in the table to see the full details of the specific email. *** ### Malicious email view Email data, enriched with insights, is displayed for each email in the following tabs: * **Overview**: General information including Internet message ID, Subject, Severity, Generated issue count, Rarity, Remediation action taken, Source, Case ID, and Status. Hover next to each field name to copy the values for further investigation. * **Message**: The full body of the email and any attachments. Each detected sentiment is categorized and highlighted with a different color. Click **View as image** to see a snapshot of the email. * **Sender and Domain**: Raw email headers, SPF, DKIM, and DMARC authentication indicators, **Sender information** , **Network information**, and **Domain intelligence**. Hover next to each field name to copy the values for further investigation. * **URLs**: Included malicious URLs. For each URL, you can see the full address, domain, category, popularity and the verdict. You can further filter the results in the table. * **Attachments**: Included attachments which are determined to be malware. * **Issues**: Issues that were generated based on this email. The fields displayed are Observation Time, Name, Detection Method, Severity, and Description. *** ### Quick remediation actions Use the more options icon at the top of the email card to take the following quick remediation actions: * **Open Causality Card**: Opens the causality card of the related issue that has the highest severity value. When the highest severity value is the same for a number of issues, opens the latest issue card. * **Soft Delete Email** * **Undelete Email** * **Report As Phishing** * **Send Warning Email** * **Move Email to Folder** * **Mark as Safe**: Changes the status of all issues related to the email as Resolved. * **Mark as Malicious** --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/cortex-advanced-email-security/malicious-email-inventory.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.