timelineEvent resource type

2025-05-21

Namespace: microsoft.graph.security

Important

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

The timeline of an analyzedEmail entity.

Properties

Property	Type	Description
eventDateTime	DateTimeOffset	The date and time when the event occurred.
eventDetails	String	Additional details or context about the event.
eventResult	String	The outcome or result of the event, such as delivery location or action taken.
eventSource	microsoft.graph.security.eventSource	The origin or actor that triggered the event. The possible values are: `system`, `admin`, `user`, `unknownFutureValue`.
eventThreats	String collection	Collection of threats identified or associated with this event.
eventType	microsoft.graph.security.timelineEventType	The type of event that occurred. The possible values are: `originalDelivery`, `systemTimeTravel`, `dynamicDelivery`, `userUrlClick`, `reprocessed`, `zap`, `quarantineRelease`, `air`, `unknown`, `unknownFutureValue`.

eventSource values

Member
system
admin
user
unknownFutureValue

timelineEventType values

Member
originalDelivery
systemTimeTravel
dynamicDelivery
userUrlClick
reprocessed
zap
quarantineRelease
air
unknown
unknownFutureValue

Relationships

None.

JSON representation

The following JSON representation shows the resource type.

{
  "@odata.type": "#microsoft.graph.security.timelineEvent",
  "eventDateTime": "String (timestamp)",
  "eventSource": "String",
  "eventType": "String",
  "eventResult": "String",
  "eventThreats": [
    "String"
  ],
  "eventDetails": "String"
}