Exposing the e-mail address behind Email Intelligence checks

Even small improvements can tremendously help you in your investigations. Adding the E-mail Value in the Event details pane is one such example. This new field represents the email address used for all Email Intelligence checks, such as identifying disposable or unreachable addresses and checking domain registration or update dates.

How is the value calculated?

1. For Risk API calls, we will use user.email from your requests, for example, in events like $login $succeeded.
2. For Filter API calls we will use params.email, for example, in events like $registration $attempted.
3. For events that support changeset we will prefer changeset.email.to, but if it is absent, we will fall back to user.email, as seen in events like: $profile_update.

Bonus: The addition of E-mail Value allows you to use it for metrics that span both Risk and Filter APIs. For example, you can count email aliases used to register new accounts or update existing ones: