Triggers a workflow on every blocked message containing a known threat.
Workflows based on this trigger will search for new events every 10 minutes.

​
Sample Event

{
	"spamScore": "<integer>",
	"phishScore": "<integer>",
	"threatsInfoMap": [
		{
			"threatID": "<string>",
			"threatStatus": "<string>",
			"classification": "<string>",
			"detectionType": "<string>",
			"threatUrl": "<string>",
			"threatTime": "<string>",
			"threat": "<string>",
			"campaignID": "<string>",
			"actors": [],
			"threatType": "<string>"
		}
	],
	"messageTime": "<string>",
	"impostorScore": "<integer>",
	"malwareScore": "<integer>",
	"cluster": "<string>",
	"subject": "<string>",
	"quarantineFolder": "<string>",
	"quarantineRule": "<string>",
	"policyRoutes": [
		"<string>",
		"<string>",
		"<string>"
	],
	"modulesRun": [
		"<string>",
		"<string>",
		"<string>",
		"<string>",
		"<string>",
		"<string>",
		"<string>",
		"<string>"
	],
	"messageSize": "<integer>",
	"headerFrom": "<string>",
	"headerReplyTo": "<string>",
	"fromAddress": [
		"<string>"
	],
	"ccAddresses": [],
	"replyToAddress": [],
	"toAddresses": [
		"<string>"
	],
	"xmailer": "<string>",
	"messageParts": [
		{
			"disposition": "<string>",
			"sha256": "<string>",
			"md5": "<string>",
			"filename": "<string>",
			"sandboxStatus": "<string>",
			"oContentType": "<string>",
			"contentType": "<string>"
		}
	],
	"completelyRewritten": "<boolean>",
	"id": "<string>",
	"QID": "<string>",
	"GUID": "<string>",
	"sender": "<string>",
	"recipient": [
		"<string>"
	],
	"senderIP": "<string>",
	"messageID": "<string>"
}