Gmail

eventName	Description	Sample	Rule
delivery	A Gmail message delivery event. The event_info.mail_event_type parameter sub-classifies into receive, send, bounce, and other delivery outcomes.	N	N

delivery: Delivery

ApplicationName: gmail

Description

A Gmail message delivery event. The event_info.mail_event_type parameter sub-classifies into receive, send, bounce, and other delivery outcomes.

References #

Gmail Activity Events

any: Gmail (any event)

Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.

ApplicationName: gmail

Description

Source-only rules that filter on applicationName 'gmail' without specifying an eventName attribute here.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.

Name	Rules	Vendors
`id.applicationName`	7 detection rules	Panther
`parameters.message_info.is_spam`	3 detection rules	Panther
`parameters.event_info.mail_event_type`	2 detection rules	Panther
`actor.email`	1 detection rule	Panther
`parameters.event_info.success`	1 detection rule	Panther
`parameters.message_info.attachment.malware_family`	1 detection rule	Panther
`parameters.message_info.connection_info.dkim_pass`	1 detection rule	Panther
`parameters.message_info.connection_info.dmarc_pass`	1 detection rule	Panther
`parameters.message_info.connection_info.spf_pass`	1 detection rule	Panther
`parameters.message_info.message_set.type`	1 detection rule	Panther

Common Indicators #

Positive field/value combinations most frequently checked by detection rules attached to this catalog entry, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`parameters.message_info.is_spam` (panther rule field)	eq	`true`	3 rules	panther

Detection Rules #

Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →

Panther #

Gsuite Attachments Downloaded from Spam Email source high application-level: Detects when a user downloads or saves to Google Drive one or more attachments that are classified as spam.T1204.002, T1566.001
Gsuite Email Bypassed Spam Filter source medium application-level: Detects if an email received by a user has bypassed the organization's spam filter.T1566
Gsuite Link Clicked in Spam Email source high application-level: Detects when a user click links contained in a received email that is classified as spam.T1204.001, T1566.002

Show 4 more (7 total) on the rules page

References #

Reports API: gmail activity events