added
Exposing the e-mail address behind Email Intelligence checks
3 months ago by Amadeusz Starzykiewicz
Even small improvements can tremendously help you in your investigations. Adding the E-mail Value in the Event details pane is one such example. This new field represents the email address used for all Email Intelligence checks, such as identifying disposable or unreachable addresses and checking domain registration or update dates.
How is the value calculated?
- For Risk API calls, we will use
user.email
from your requests, for example, in events like$login
$succeeded
. - For Filter API calls we will use
params.email
, for example, in events like$registration
$attempted
. - For events that support
changeset
we will preferchangeset.email.to
, but if it is absent, we will fall back touser.email
, as seen in events like:$profile_update
.
Bonus: The addition of E-mail Value allows you to use it for metrics that span both Risk and Filter APIs. For example, you can count email aliases used to register new accounts or update existing ones: