{
"data": {
"alert": {
"id": "01a03a4e-0a7e-7358-b8d3-a799d94cd680",
"externalId": "98da58d9-5feb-4f37-8f4a-95f76e32131c",
"name": "Phishing",
"description": "A message containing a malicious URL was delivered to a user mailbox.",
"severity": "HIGH",
"status": "NEW",
"classification": "PHISHING",
"analystVerdict": "UNDEFINED",
"detectedAt": "2026-01-01T15:56:21.000Z",
"primaryIndicatorType": "url - https://malicious.example.com/login",
"selfLink": "https://usea1-example.sentinelone.net/incidents/unified-alerts?alertId=01a03a4e-0a7e-7358-b8d3-a799d94cd680",
"detectionSource": {
"product": "Proofpoint",
"vendor": "Proofpoint"
},
"analytics": null,
"assets": [
{
"name": "john.doe@example.com",
"assetTypeClassifier": "User",
"agentUuid": null
}
],
"detectionTime": {
"asset": null,
"attacker": null,
"targetUser": {
"name": "John Doe",
"domain": "example.com",
"emailAddress": "john.doe@example.com"
},
"cloud": null
},
"process": null,
"observables": [],
"indicators": [
{
"type": "url - https://malicious.example.com/login",
"observables": [
{
"name": "threat url",
"type": "URL_STRING",
"typeName": "URL String",
"value": "https://malicious.example.com/login"
}
],
"attacks": null
}
],
"rawData": {
"raw_data": "{\"threatsInfoMap\": [{\"threatType\": \"url\", \"threat\": \"https://malicious.example.com/login\"}]}"
}
}
}
}
