---
title: "Get SIEM-oriented summary of flagged message groups"
method: GET
path: "/v0/message-groups/siem-summary"
tags: ["Message Groups"]
---

# Get SIEM-oriented summary of flagged message groups

`GET /v0/message-groups/siem-summary`

Returns a paginated, reduced-field summary of flagged message groups intended for SIEM ingestion. Array fields are bounded to keep payloads under typical SIEM batch limits.

## Query parameters

- `cursor` string, nullable — Opaque pagination cursor returned in the previous response's cursor field.
- `limit` integer — The maximum number of message groups to return.
- `timestamp__gte` string, date-time, nullable — Inclusive lower bound on the sort timestamp (newest_created_at for type=flagged, first_reported_as_phish_at for type=reported).
- `timestamp__lt` string, date-time, nullable — Exclusive upper bound on the sort timestamp (newest_created_at for type=flagged, first_reported_as_phish_at for type=reported).
- `type` 'flagged' | 'reported' — Which timestamp the endpoint sorts/filters on: 'flagged' uses newest_created_at, 'reported' uses first_reported_as_phish_at.

## Response `200`

OK

- HandlerTypesMessageGroupSIEMSummaryResponse
  - `cursor` string, nullable — Opaque cursor for the next page; pass it back as the cursor query param. Null when no more pages are available.
  - `message_groups` HandlerTypesMessageGroupSIEMSummaryItem[] — List of flagged message groups for SIEM ingestion
    - `attachment_hashes` BoundedValuesString — Bounded first attachment names on messages in the group
      - `total` integer
      - `values` string[]
    - `attachment_names` BoundedValuesString — Bounded first attachment names on messages in the group
      - `total` integer
      - `values` string[]
    - `detection_rule_names` string[] — Names of detection rules that flagged messages in the group
    - `first_seen` string, date-time — Oldest message effective_at in the group
    - `id` string — Canonical ID of the message group
    - `last_seen` string, date-time — Newest message effective_at in the group
    - `link_clicks` TruncatedBoundedValuesHandlerTypesMessageGroupActivityEvent — Link clicks observed on messages in the group, newest first; for full history use GET /v1/messages/groups/{id}/activity?type=click
      - `total` integer
      - `truncated` boolean
      - `values` HandlerTypesMessageGroupActivityEvent[]
        - `client_ip` string, nullable — Client IP of the click (click events only)
        - `forward_recipients` BoundedValuesString — Bounded first attachment names on messages in the group
          - `total` integer
          - `values` string[]
        - `mailbox` HandlerTypesMessageGroupActivityEventMailbox — Details about the mailbox associated with the message, except for 'received' events
          - `display_name` string, nullable — Display name of the mailbox
          - `email_address` string — Email address of the mailbox
          - `external_id` string, nullable — External ID of the mailbox
        - `message_id` string, nullable — ID of the message, except for 'received' events
        - `recipients` TruncatedBoundedValuesString — The first recipient email addresses of the message involved in the event (received events only), may truncate with as few as 1 recipient
          - `total` integer
          - `truncated` boolean
          - `values` string[]
        - `timestamp` string, date-time — Time of the event
        - `type` string — Type of activity event
        - `url` string, nullable — URL that was clicked (click events only)
        - `user_agent` string, nullable — User agent of the click (click events only)
    - `message_count` integer — Effective number of messages in the group
    - `recipient_count` integer — Number of unique recipients across the group
    - `sender_domains` BoundedValuesString — Bounded first attachment names on messages in the group
      - `total` integer
      - `values` string[]
    - `senders` BoundedValuesString — Bounded first attachment names on messages in the group
      - `total` integer
      - `values` string[]
    - `source_ips` TruncatedBoundedValuesString — The first recipient email addresses of the message involved in the event (received events only), may truncate with as few as 1 recipient
      - `total` integer
      - `truncated` boolean
      - `values` string[]
    - `subjects` BoundedValuesString — Bounded first attachment names on messages in the group
      - `total` integer
      - `values` string[]

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/revisions/d5df82850357/schema)