> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email.md). # xdm.email Email fields. | | | | --------- | -------------- | | Datatype | Compound.Email | | Dataclass | Compound | ## Field groups * [`xdm.email.attachment`](/xsiam-data-model-schema/fields/email/attachment.md) ## Fields #### `xdm.email.recipients` | | | | ----------- | ------------------------------------ | | Description | A list of the recipients' addresses. | | Datatype | EmailAddress | | Dataclass | Array | #### `xdm.email.recipients_names` | | | | ----------- | -------------------------------- | | Description | A list of the recipients' names. | | Datatype | String | | Dataclass | Array | #### `xdm.email.subject` | | | | ----------- | ------------------------------ | | Description | The subject line of the email. | | Datatype | String | | Dataclass | Scalar | #### `xdm.email.cc` | | | | ----------- | ------------------------- | | Description | A list of 'cc' addresses. | | Datatype | EmailAddress | | Dataclass | Array | #### `xdm.email.cc_names` | | | | ----------- | --------------------- | | Description | A list of 'cc' names. | | Datatype | String | | Dataclass | Array | #### `xdm.email.bcc` | | | | ----------- | -------------------------- | | Description | A list of 'bcc' addresses. | | Datatype | EmailAddress | | Dataclass | Array | #### `xdm.email.bcc_names` | | | | ----------- | ---------------------- | | Description | A list of 'bcc' names. | | Datatype | String | | Dataclass | Array | #### `xdm.email.sender` | | | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The sender address. Indicates the actual sender of the message if different from the value specified in the 'From' header (e.g., someone sending on behalf of another). Extracted from the 'Sender' header | | Datatype | EmailAddress | | Dataclass | Scalar | #### `xdm.email.data` | | | | ----------- | ------------------------------------------ | | Description | The actual message sent, encoded in UTF-8. | | Datatype | String | | Dataclass | Scalar | #### `xdm.email.mime` | | | | ----------- | ----------------------------------------------------- | | Description | Information about how the message is to be displayed. | | Datatype | String | | Dataclass | Scalar | #### `xdm.email.return_path` | | | | ----------- | ------------------------------------------------------------------------- | | Description | The header that indicates where and how bounced emails will be processed. | | Datatype | String | | Dataclass | Scalar | #### `xdm.email.message_id` | | | | ----------- | -------------------------------------------------------------------- | | Description | An identifier of the email, as generated by the sending mail system. | | Datatype | String | | Dataclass | Scalar | #### `xdm.email.delivery_timestamp` | | | | ----------- | -------------------------------------- | | Description | The time that the email was delivered. | | Datatype | Timestamp | | Dataclass | Scalar | #### `xdm.email.origination_timestamp` | | | | ----------- | --------------------------------- | | Description | The time that the email was sent. | | Datatype | Timestamp | | Dataclass | Scalar | #### `xdm.email.sender_name` | | | | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The sender name. Extracted from the 'Sender' header. The 'Sender' header specifies the mailbox of the agent responsible for actually sending the message on behalf of the author(s) | | Datatype | String | | Dataclass | Array | #### `xdm.email.detection_tags` | | | | ----------- | ------------------------------------------------------------------------ | | Description | Tags for detection, used in user interface classification and filtering. | | Datatype | String | | Dataclass | Array | #### `xdm.email.mailbox_owner` | | | | ----------- | -------------------------------------------------------------------- | | Description | Mail address of the mailbox from which the email was retrieved from. | | Datatype | EmailAddress | | Dataclass | Scalar | #### `xdm.email.is_draft` | | | | ----------- | ----------------------------------------------- | | Description | Indicates whether the email is a draft message. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.email.url_categories` | | | | ----------- | ------------------------------------------------- | | Description | Categories of classifications applied to the URL. | | Datatype | String | | Dataclass | Array | #### `xdm.email.conversation_id` | | | | ----------- | ------------------------------------------------- | | Description | Unique identifier of email thread (conversation). | | Datatype | String | | Dataclass | Scalar | #### `xdm.email.creation_time` | | | | ----------- | ---------------------------- | | Description | The time the email was sent. | | Datatype | UnixMillis | | Dataclass | Scalar | #### `xdm.email.from_address` | | | | ----------- | ------------------------------------------------------------------------------------------------------------------ | | Description | The From address. Indicates the originator of the email as seen by the recipient. Extracted from the 'From' header | | Datatype | EmailAddress | | Dataclass | Scalar | #### `xdm.email.from_name` | | | | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The From name. Extracted from the 'From' header. The 'From' header identifies the author(s) of the message — the person(s) or system(s) who wrote the message. | | Datatype | String | | Dataclass | Scalar | #### `xdm.email.normalized_urls` | | | | ----------- | -------------------------- | | Description | A list of normalized URLs. | | Datatype | URL | | Dataclass | Array | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/email.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.