Gmail

eventName	Description	Sample	Rule
any	Source-only rules that filter on applicationName 'gmail' without specifying an eventName attribute here.	N	Y
delivery	A Gmail message delivery event. The event_info.mail_event_type parameter sub-classifies into receive, send, bounce, and other delivery outcomes.	N	N

any: Gmail (any event)

Source-only rules that filter on applicationName 'gmail' without specifying an eventName attribute here.

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`parameters.message_info.is_spam` (panther rule field)	eq	`true`	3 rules	panther

Gsuite Attachments Downloaded from Spam Email source high application-level: Detects when a user downloads or saves to Google Drive one or more attachments that are classified as spam.T1204.002, T1566.001
Gsuite Email Bypassed Spam Filter source medium application-level: Detects if an email received by a user has bypassed the organization's spam filter.T1566
Gsuite Link Clicked in Spam Email source high application-level: Detects when a user click links contained in a received email that is classified as spam.T1204.001, T1566.002

A Gmail message delivery event. The event_info.mail_event_type parameter sub-classifies into receive, send, bounce, and other delivery outcomes.