Alert

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/mandiant/main/json-schema/mandiant-alert-schema.json",
  "title": "Alert",
  "description": "An alert is created for each monitor that has at least one matching condition. The alert includes details and context regarding the (raw) document matched, the topics/labels matched from the monitor, as well as the labels and topics identified within the (raw) document.",
  "x-generated": "2026-10-20",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/mandiant-dtm-openapi.yml#/components/schemas/Alert",
  "properties": {
    "aggregated_added_at": {
      "description": "Only applicable to alert buckets, this field is the timestamp at which the most recent child alert was aggregated into the bucket.",
      "format": "date-time",
      "readOnly": true,
      "type": "string"
    },
    "aggregated_alert_count": {
      "description": "Only applicable to alert buckets, and indicates the number of alerts aggregated into this bucket alert.",
      "readOnly": true,
      "type": "integer"
    },
    "aggregated_alert_count_new": {
      "description": "Only applicable to alert buckets, and indicates the number of alerts with new status in this bucket alert.",
      "readOnly": true,
      "type": "integer"
    },
    "aggregated_alerts": {
      "description": "Only applciable to alert buckets, this field contains metadata about each child alert aggregated into this bucket.",
      "items": {
        "$ref": "#/$defs/AggregatedAlertRef"
      },
      "readOnly": true,
      "type": "array"
    },
    "aggregated_under_id": {
      "description": "Only applicable to child alerts that are aggregated into a bucket, this field is the ID of the parent bucket alert.",
      "readOnly": true,
      "type": "string"
    },
    "alert_summary": {
      "description": "The summary of the alert.",
      "readOnly": true,
      "type": "string"
    },
    "alert_type": {
      "description": "The type of this alert.",
      "enum": [
        "Compromised Credentials",
        "Domain Discovery",
        "Forum Post",
        "Message",
        "Paste",
        "Shop Listing",
        "Tweet",
        "Web Content"
      ],
      "readOnly": true,
      "type": "string"
    },
    "analysis": {
      "description": "If analysis has been added to the alert, then this property contains the analysis text.",
      "readOnly": false,
      "type": "string"
    },
    "attachments": {
      "description": "File attachments associated with the alert as part of the alert's analysis.",
      "items": {
        "$ref": "#/$defs/FileAttachment"
      },
      "readOnly": true,
      "type": "array"
    },
    "created_at": {
      "description": "The time this alert was created at.",
      "readOnly": true,
      "type": "string"
    },
    "doc": {
      "oneOf": [
        {
          "$ref": "#/$defs/email_analysis"
        },
        {
          "$ref": "#/$defs/paste"
        },
        {
          "$ref": "#/$defs/tweet"
        },
        {
          "$ref": "#/$defs/document_analysis"
        },
        {
          "$ref": "#/$defs/drone_discovery"
        },
        {
          "$ref": "#/$defs/message"
        },
        {
          "$ref": "#/$defs/shop_listing"
        },
        {
          "$ref": "#/$defs/account_discovery"
        },
        {
          "$ref": "#/$defs/forum_post"
        },
        {
          "$ref": "#/$defs/domain_discovery"
        },
        {
          "$ref": "#/$defs/web_content_publish"
        }
      ],
      "readOnly": true
    },
    "doc_matches": {
      "description": "Any document matches generated for this alert.",
      "items": {
        "$ref": "#/$defs/Doc_match"
      },
      "readOnly": true,
      "type": "array"
    },
    "doc_url": {
      "description": "The URL to the document that triggered this alert.",
      "format": "uri",
      "readOnly": true,
      "type": "string"
    },
    "email_sent_at": {
      "description": "If email notifications are used for this alert, the timestamp the alert email was sent.",
      "readOnly": true,
      "type": "string"
    },
    "has_analysis": {
      "description": "True if the alert has analysis text or file attachments and false otherwise.",
      "readOnly": true,
      "type": "boolean"
    },
    "id": {
      "description": "The ID of the alert.",
      "readOnly": true,
      "type": "string"
    },
    "indicator_attributions": {
      "items": {
        "$ref": "#/$defs/IndicatorAttribution"
      },
      "readOnly": true,
      "type": "array"
    },
    "indicator_mscore": {
      "maximum": 100,
      "minimum": 0,
      "readOnly": true,
      "type": "integer"
    },
    "label_matches": {
      "description": "Any labels that matched for this alert.",
      "items": {
        "$ref": "#/$defs/Label_match"
      },
      "readOnly": true,
      "type": "array"
    },
    "labels": {
      "description": "The labels itentified in the document that triggered this alert.",
      "items": {
        "$ref": "#/$defs/Label"
      },
      "readOnly": true,
      "type": "array"
    },
    "labels_url": {
      "description": "The URL to the labels identified in the document that triggered this alert.",
      "format": "uri",
      "readOnly": true,
      "type": "string"
    },
    "meets_password_policy": {
      "description": "If the monitor that created the alert includes a password policy, this value indicates if the alert (when applicable) has a password that meets the policy.",
      "readOnly": true,
      "type": "boolean"
    },
    "monitor_id": {
      "description": "The ID of the monitor that generated this alert.",
      "readOnly": true,
      "type": "string"
    },
    "monitor_name": {
      "description": "The name of the monitor that generated this alert.",
      "readOnly": true,
      "type": "string"
    },
    "monitor_version": {
      "description": "The version of the monitor that generated this alert.",
      "readOnly": true,
      "type": "integer"
    },
    "relevance_class": {
      "description": "The relevance class suggested for this alert.",
      "enum": [
        "benign",
        "malicious"
      ],
      "type": "string"
    },
    "relevance_probability": {
      "description": "The relevance probability suggested for this alert.",
      "readOnly": true,
      "type": "number"
    },
    "status": {
      "description": "The status of this alert.",
      "enum": [
        "new",
        "closed",
        "read",
        "escalated",
        "in_progress",
        "no_action_required",
        "duplicate",
        "not_relevant",
        "tracked_external"
      ],
      "type": "string"
    },
    "tags": {
      "description": "The tags set for this alert.",
      "items": {
        "type": "string"
      },
      "readOnly": false,
      "type": "array"
    },
    "title": {
      "description": "The title of this alert.",
      "readOnly": true,
      "type": "string"
    },
    "topic_matches": {
      "description": "Any topic matches the monitor generated for this alert.",
      "items": {
        "$ref": "#/$defs/Topic_match"
      },
      "readOnly": true,
      "type": "array"
    },
    "topics": {
      "description": "The topics that were identified in the document that triggered this alert.",
      "items": {
        "$ref": "#/$defs/Topic"
      },
      "readOnly": true,
      "type": "array"
    },
    "topics_url": {
      "description": "The URL to the toics identified in the document that triggered this alert.",
      "format": "uri",
      "readOnly": true,
      "type": "string"
    },
    "updated_at": {
      "description": "The time this alert was last updated at.",
      "readOnly": true,
      "type": "string"
    }
  },
  "required": [
    "id",
    "monitor_id",
    "created_at",
    "updated_at",
    "topic_matches",
    "doc_matches",
    "doc_url",
    "labels_url",
    "topics_url",
    "status",
    "alert_type",
    "alert_summary",
    "title",
    "label_matches",
    "indicator_attributions",
    "monitor_version"
  ],
  "type": "object",
  "$defs": {
    "AggregatedAlertRef": {
      "description": "Metadata about an aggregated alert that belongs to a parent alert bucket.",
      "properties": {
        "created_at": {
          "description": "The time the child alert was created.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "doc_type": {
          "description": "The document type of the child alert.",
          "readOnly": true,
          "type": "string"
        },
        "has_analysis": {
          "description": "A boolean indicating if the child alert has analysis or file attachments.",
          "readOnly": true,
          "type": "boolean"
        },
        "id": {
          "description": "The ID of the aggregated chid alert.",
          "readOnly": true,
          "type": "string"
        },
        "monitor_id": {
          "description": "The ID of the monitor that generated the child alert.",
          "readOnly": true,
          "type": "string"
        },
        "status": {
          "description": "The status of the child alert.",
          "enum": [
            "new",
            "read",
            "escalated",
            "in_progress",
            "closed",
            "no_action_required",
            "duplicate",
            "not_relevant",
            "tracked_external"
          ],
          "readOnly": true,
          "type": "string"
        },
        "tags": {
          "description": "The tags of the child alert.",
          "items": {
            "type": "string"
          },
          "maxItems": 100,
          "type": "array"
        }
      },
      "title": "Aggregated Alert Reference",
      "type": "object"
    },
    "Doc_match": {
      "description": "A Doc Match represents the doc query that was matched for a monitor alert.",
      "properties": {
        "locations": {
          "description": "A list of locations for the match.",
          "items": {
            "$ref": "#/$defs/Location"
          },
          "minItems": 1,
          "readOnly": true,
          "type": "array"
        },
        "match_path": {
          "description": "The JSON field path of the match.",
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "match_path",
        "locations"
      ],
      "title": "Doc Match",
      "type": "object"
    },
    "Entity_location": {
      "description": "The location of a Topic (entity) identified within a (raw) document",
      "properties": {
        "element_path": {
          "description": "The JSON field path at which the entity was found in the raw document.",
          "readOnly": true,
          "type": "string"
        },
        "offsets": {
          "description": "The list of offsets where the entity was found in the element_path.",
          "items": {
            "type": "integer"
          },
          "maxItems": 2,
          "minItems": 2,
          "readOnly": true,
          "type": "array"
        }
      },
      "required": [
        "element_path",
        "offsets"
      ],
      "title": "Entity Location",
      "type": "object"
    },
    "FileAttachment": {
      "description": "Metadata describing a file attachment.",
      "properties": {
        "content_type": {
          "description": "The content type of the file attachment.",
          "readOnly": true,
          "type": "string"
        },
        "created_at": {
          "description": "The time the file attachment was created.",
          "format": "date-time",
          "readOnly": true,
          "type": "string"
        },
        "created_by_user_id": {
          "description": "The user ID that created the attachment.",
          "readOnly": true,
          "type": "string"
        },
        "filesize_bytes": {
          "description": "The size of the attachment measured in bytes.",
          "readOnly": true,
          "type": "integer"
        },
        "id": {
          "description": "The ID of the file attachment.",
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "description": "The file name of the attachment.",
          "readOnly": true,
          "type": "string"
        }
      },
      "title": "File Attachment",
      "type": "object"
    },
    "IndicatorAttribution": {
      "description": "Attributions assodicated with an indicator.",
      "properties": {
        "id": {
          "readOnly": true,
          "type": "string"
        },
        "name": {
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "id",
        "name",
        "type"
      ],
      "title": "Indicator Attribution",
      "type": "object",
      "x-stoplight": {
        "id": "afpk4k0z11ag1"
      }
    },
    "Label": {
      "description": "A Label identified within a (raw) document.",
      "properties": {
        "classifier": {
          "description": "The classifier that identified this label.",
          "readOnly": true,
          "type": "string"
        },
        "confidence": {
          "description": "The confidence estimate that the label was identified properly.",
          "readOnly": true,
          "type": "integer"
        },
        "element_path": {
          "description": "The JSON field path in the raw document where the label was identified.",
          "readOnly": true,
          "type": "string"
        },
        "id": {
          "description": "The ID of the label.",
          "readOnly": true,
          "type": "string"
        },
        "label": {
          "description": "The label value.",
          "readOnly": true,
          "type": "string"
        },
        "version": {
          "description": "The version of the classifier that identified this label.",
          "type": "string"
        }
      },
      "required": [
        "id",
        "classifier",
        "version",
        "label",
        "confidence",
        "element_path"
      ],
      "title": "Label",
      "type": "object"
    },
    "Label_match": {
      "description": "Indication of a label matching a monitor condition for label topics",
      "properties": {
        "label_id": {
          "description": "The ID of the identified label that was matched.",
          "type": "string"
        },
        "value": {
          "description": "The label value that was matched.",
          "type": "string"
        }
      },
      "required": [
        "label_id",
        "value"
      ],
      "title": "Label Match",
      "type": "object"
    },
    "Location": {
      "description": "Location represents a text location as specified by its start and end index and its matching value.",
      "properties": {
        "match_path": {
          "readOnly": true,
          "type": "string"
        },
        "offsets": {
          "description": "The offsets in the raw document where the value was identified.",
          "items": {
            "type": "integer"
          },
          "maxItems": 2,
          "minItems": 2,
          "readOnly": true,
          "type": "array"
        },
        "value": {
          "description": "The value that was identified.",
          "maxLength": 1000,
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "offsets",
        "value"
      ],
      "title": "Location",
      "type": "object"
    },
    "Topic": {
      "description": "A topic identified within a (raw) document",
      "properties": {
        "confidence": {
          "description": "The estimated confidence that the value was properly idenitified.",
          "maximum": 100,
          "readOnly": true,
          "type": "integer"
        },
        "entity_locations": {
          "description": "The locations of the identified entities.",
          "items": {
            "$ref": "#/$defs/Entity_location"
          },
          "readOnly": true,
          "type": "array"
        },
        "extractor": {
          "description": "The name of the extractor that identified the topic value.",
          "readOnly": true,
          "type": "string"
        },
        "id": {
          "description": "The ID of the identified topic.",
          "readOnly": true,
          "type": "string"
        },
        "type": {
          "description": "The type of the topic.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "The value identified for the topic.",
          "readOnly": true,
          "type": "string"
        },
        "version": {
          "description": "The version of the extractor.",
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "id",
        "value",
        "type",
        "extractor",
        "version",
        "confidence",
        "entity_locations"
      ],
      "title": "Topic",
      "type": "object"
    },
    "Topic_match": {
      "description": "A topic match indicates which search and topic was matched for a monitor alert.",
      "properties": {
        "topic_id": {
          "description": "The ID of the topic corresponding to this match.",
          "readOnly": true,
          "type": "string"
        },
        "value": {
          "description": "The value of the topic that matched.",
          "readOnly": true,
          "type": "string"
        }
      },
      "required": [
        "topic_id",
        "value"
      ],
      "title": "Topic Match",
      "type": "object"
    },
    "account_discovery": {
      "properties": {
        "__meta": {
          "title": "__meta",
          "type": ""
        },
        "service_account": {
          "$ref": "#/$defs/service_account"
        },
        "source_file": {
          "$ref": "#/$defs/file"
        },
        "source_threat": {
          "$ref": "#/$defs/threat"
        },
        "source_url": {
          "$ref": "#/$defs/url"
        }
      },
      "title": "account_discovery",
      "type": "object"
    },
    "bin": {
      "title": "bin",
      "type": "string"
    },
    "bot": {
      "properties": {
        "bot_id": {
          "$ref": "#/$defs/bot_id"
        },
        "botnet_id": {
          "$ref": "#/$defs/botnet_id"
        },
        "controllers": {
          "items": {
            "$ref": "#/$defs/inet_location"
          },
          "type": "array"
        },
        "exfil_locations": {
          "items": {
            "$ref": "#/$defs/inet_location"
          },
          "type": "array"
        },
        "sample_hashes": {
          "$ref": "#/$defs/hashes"
        }
      },
      "title": "bot",
      "type": "object"
    },
    "bot_id": {
      "title": "bot_id",
      "type": "string"
    },
    "botnet_id": {
      "title": "botnet_id",
      "type": "string"
    },
    "brand": {
      "title": "brand",
      "type": "string"
    },
    "channel": {
      "properties": {
        "__id": {
          "title": "__id",
          "type": "string"
        },
        "__type": {
          "title": "__type",
          "type": "string"
        },
        "channel_id": {
          "title": "channel_id",
          "type": "string"
        },
        "channel_info": {
          "$ref": "#/$defs/channel_info"
        },
        "channel_url": {
          "$ref": "#/$defs/url"
        },
        "invite_url": {
          "$ref": "#/$defs/url"
        },
        "messenger": {
          "$ref": "#/$defs/service"
        },
        "name": {
          "$ref": "#/$defs/name"
        }
      },
      "title": "channel",
      "type": "object"
    },
    "channel_info": {
      "properties": {
        "description": {
          "title": "description",
          "type": "string"
        }
      },
      "title": "channel_info",
      "type": "object"
    },
    "city": {
      "title": "city",
      "type": "string"
    },
    "contact": {
      "properties": {
        "__id": {
          "title": "__id",
          "type": "string"
        },
        "__type": {
          "title": "__type",
          "type": "string"
        },
        "aim": {
          "title": "aim",
          "type": "string"
        },
        "email": {
          "$ref": "#/$defs/email_address"
        },
        "email_domain": {
          "$ref": "#/$defs/domain"
        },
        "email_redacted": {
          "title": "email_redacted",
          "type": "string"
        },
        "fax": {
          "$ref": "#/$defs/phone_number"
        },
        "geo_location": {
          "$ref": "#/$defs/geo_location"
        },
        "icq": {
          "$ref": "#/$defs/icq_uin"
        },
        "jid": {
          "$ref": "#/$defs/jid"
        },
        "msnm": {
          "title": "msnm",
          "type": "string"
        },
        "phone": {
          "$ref": "#/$defs/phone_number"
        },
        "twitter_handle": {
          "$ref": "#/$defs/twitter_handle"
        },
        "website": {
          "$ref": "#/$defs/url"
        }
      },
      "title": "contact",
      "type": "object"
    },
    "content_type": {
      "title": "content_type",
      "type": "string"
    },
    "continent_code": {
      "title": "continent_code",
      "type": "string"
    },
    "country": {
      "title": "country",
      "type": "string"
    },
    "country_code": {
      "title": "country_code",
      "type": "string"
    },
    "country_code_3": {
      "title": "country_code_3",
      "type": "string"
    },
    "cpu": {
      "properties": {
        "cores": {
          "format": "int32",
          "title": "cores",
          "type": "integer"
        },
        "product": {
          "$ref": "#/$defs/product"
        }
      },
      "title": "cpu",
      "type": "object"
    },
    "data_availability": {
      "properties": {
        "__id": {
          "title": "__id",
          "type": "string"
        },
        "__type": {
          "title": "__type",
          "type": "string"
        },
        "admin_access_available": {
          "title": "admin_access_available",
          "type": "boolean"
        },
        "cvc_available": {
          "title": "cvc_available",
          "type": "boolean"
        },
        "dob_available": {
          "title": "dob_available",
          "type": "boolean"
        },
        "email_available": {
          "title": "email_available",
          "type": "boolean"
        },
        "geo_location_available": {
          "title": "geo_location_available",
          "type": "boolean"
        },
        "mmn_available": {
          "title": "mmn_available",
          "type": "boolean"
        },
        "name_available": {
          "title": "name_available",
          "type": "boolean"
        },
        "phone_available": {
          "title": "phone_available",
          "type": "boolean"
        },
        "pin_available": {
          "title": "pin_available",
          "type": "boolean"
        },
        "pvki_available": {
          "title": "pvki_available",
          "type": "boolean"
        },
        "pvv_available": {
          "title": "pvv_available",
          "type": "boolean"
        },
        "ssn_available": {
          "title": "ssn_available",
          "type": "boolean"
        },
        "track1_available": {
          "title": "track1_available",
          "type": "boolean"
        },
        "track2_available": {
          "title": "track2_available",
          "type": "boolean"
        },
        "vbv_available": {
          "title": "vbv_available",
          "type": "boolean"
        }
      },
      "title": "data_availability",
      "type": "object"
    },
    "dns_rr": {
      "properties": {
        "__id": {
          "title": "__id",
          "type": "string"
        },
        "__type": {
          "title": "__type",
          "type": "string"
        },
        "priority": {
          "format": "int32",
          "title": "priority",
          "type": "integer"
        },
        "rdata_domain": {
          "$ref": "#/$defs/domain"
        },
        "rdata_ipv4": {
          "$ref": "#/$defs/ipv4_address"
        },
        "type": {
          "title": "type",
          "type": "string"
        }
      },
      "title": "dns_rr",
      "type": "object"
    },
    "document_analysis": {
      "properties": {
        "__meta": {
          "title": "__meta",
          "type": ""
        },
        "content_type": {
          "$ref": "#/$defs/content_type"
        },
        "created": {
          "format": "date-time",
          "title": "created",
          "type": "string"
        },
        "creator": {
          "$ref": "#/$defs/identity_name"
        },
        "description": {
          "title": "description",
          "type": "string"
        },
        "file_hashes": {
          "$ref": "#/$defs/hashes"
        },
        "filename": {
          "$ref": "#/$defs/filename"
        },
        "language": {
          "$ref": "#/$defs/language"
        },
        "modified": {
          "format": "date-time",
          "title": "modified",
          "type": "string"
        },
        "raw_text": {
          "title": "raw_text",
          "type": "string"
        },
        "source_url": {
          "$ref": "#/$defs/url"
        },
        "title": {
          "title": "title",
          "type": "string"
        }
      },
      "title": "document_analysis",
      "type": "object"
    },
    "domain": {
      "title": "domain",
      "type": "string"
    },
    "domain_discovery": {
      "properties": {
        "__id": {
          "title": "__id",
          "type": "string"
        },
        "__meta": {
          "title": "__meta",
          "type": ""
        },
        "__type": {
          "title": "__type",
          "type": "string"
        },
        "domain": {
          "$ref": "#/$defs/domain"
        },
        "domain_whois": {
          "$ref": "#/$defs/domain_whois"
        },
        "ingested": {
          "format": "date-time",
          "title": "ingested",
          "type": "string"
        },
        "rr": {
          "items": {
            "$ref": "#/$defs/dns_rr"
          },
          "type": "array"
        },
        "similar_domains": {
          "items": {
            "$ref": "#/$defs/domain"
          },
          "type": "array"
        },
        "source": {
          "title": "source",
          "type": "string"
        },
        "timestamp": {
          "format": "date-time",
          "title": "timestamp",
          "type": "string"
        }
      },
      "title": "domain_discovery",
      "type": "object"
    },
    "domain_whois": {
      "properties": {
        "__id": {
          "title": "__id",
          "type": "string"
        },
        "__type": {
          "title": "__type",
          "type": "string"
        },
        "created": {
          "format": "date-time",
          "title": "created",
          "type": "string"
        },
        "domain": {
          "$ref": "#/$defs/domain"
        },
        "expires": {
          "format": "date-time",
          "title": "expires",
          "type": "string"
        },
        "nameservers": {
          "items": {
            "$ref": "#/$defs/domain"
          },
          "type": "array"
        },
        "raw_text": {
          "title": "raw_text",
          "type": "string"
        },
        "registrant": {
          "$ref": "#/$defs/profile"
        },
        "registrar": {
          "$ref": "#/$defs/profile"
        },
        "source": {
          "title": "source",
          "type": "string"
        },
        "statuses": {
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "timestamp": {
          "format": "date-time",
          "title": "timestamp",
          "type": "string"
        },
        "updated": {
          "format": "date-time",
          "title": "updated",
          "type": "string"
        }
      },
      "title": "domain_whois",
      "type": "object"
    },
    "drone_discovery": {
      "properties": {
        "__meta": {
          "title": "__meta",
          "type": ""
        },
        "bot": {
          "$ref": "#/$defs/bot"
        },
        "created": {
          "format": "date-time",
          "title": "created",
          "type": "string"
        },
        "host_info": {
          "$ref": "#/$defs/host_info"
        },
        "source_file": {
          "$ref": "#/$defs/file"
        },
        "source_url": {
          "$ref": "#/$defs/url"
        },
        "threat": {
          "$ref": "#/$defs/threat"
        },
        "updated": {
          "format": "date-time",
          "title": "updated",
          "type": "string"
        },
        "user_name": {
          "$ref": "#/$defs/identity_name"
        }
      },
      "title": "drone_discovery",
      "type": "object"
    },
    "email": {
      "properties": {
        "bcc": {
          "items": {
            "$ref": "#/$defs/profile"
          },
          "type": "array"
        },
        "body": {
          "title": "body",
          "type": "string"
        },
        "body_multipart": {
          "items": {
            "$ref": "#/$defs/mime_part"
          },
          "type": "array"
        },
        "cc": {
          "items": {
            "$ref": "#/$defs/profile"
          },
          "type": "array"
        },
        "content_type": {
          "$ref": "#/$defs/content_type"
        },
        "email_hashes": {
          "$ref": "#/$defs/hashes"
        },
        "from": {
          "$ref": "#/$defs/profile"
        },
        "headers": {
          "items": {
            "$ref": "#/$defs/email_header"
          },
          "type": "array"
        },
        "in_reply_to": {
          "$ref": "#/$defs/message_id"
        },
        "is_multipart": {
          "title": "is_multipart",
          "type": "boolean"
        },
        "message_date": {
          "format": "date-time",
          "title": "message_date",
          "type": "string"
        },
        "message_id": {
          "$ref": "#/$defs/message_id"
        },
        "received_from_locations": {
          "items": {
            "$ref": "#/$defs/inet_location"
          },
          "type": "array"
        },
        "sender": {
          "$ref": "#/$defs/profile"
        },
        "subject": {
          "title": "subject",
          "type": "string"
        },
        "to": {
          "items": {
            "$ref": "#/$defs/profile"
          },
          "type": "array"
        }
      },
      "title": "email",
      "type": "object"
    },
    "email_address": {
      "title": "email_address",
      "type": "string"
    },
    "email_analysis": {
      "properties": {
        "__meta": {
          "title": "__meta",
          "type": ""
        },
        "email": {
          "$ref": "#/$defs/email"
        },
        "inet_locations": {
          "items": {
            "$ref": "#/$defs/inet_location"
          },
          "type": "array"
        },
        "source_url": {
          "$ref": "#/$defs/url"
        },
        "timestamp_scope": {
          "title": "timestamp_scope",
          "type": "string"
        }
      },
      "title": "email_analysis",
      "type": "object"
    },
    "email_header": {
      "properties": {
        "name": {
          "title": "name",
          "type": "string"
        },
        "value": {
          "title": "value",
          "type": "string"
        }
      },
      "title": "email_header",
      "type": "object"
    },
    "file": {
      "properties": {
        "file_type": {
          "title": "file_type",
          "type": "string"
        },
        "filename": {
          "$ref": "#/$defs/filename"
        },
        "hashes": {
          "$ref": "#/$defs/hashes"
        },
        "mime_type": {
          "title": "mime_type",
          "type": "string"
        },
        "size": {
          "format": "int64",
          "title": "size",
          "type": "integer"
        }
      },
      "title": "file",
      "type": "object"
    },
    "filename": {
      "title": "filename",
      "type": "string"
    },
    "forum_post": {
      "properties": {
        "__id": {
          "title": "__id",
          "type": "string"
        },
        "__meta": {
          "title": "__meta",
          "type": ""
        },
        "__type": {
          "title": "__type",
          "type":

# --- truncated at 32 KB (68 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-alert-schema.json