Email phishing log

This report is an event-level phishing log: one row per observed simulation interaction (date, action, recipient email, subject, from, difficulty). It stays long-form — it does not collapse a person’s history into a single result. The query folds a trailing 12 calendar months into occurred_after (midnight UTC on the same day-of-month twelve months ago — not a 365-day duration). Setup, credentials, pagination, and rate-limit retry are the same as the Power BI / Excel connectivity guide. Add the shared Fn_FetchAll query first; this report calls it by name.

​

Required key scopes

A key granted only simulation:read cannot call the reporting events endpoint (the API returns 403). See choose the right grain.

​

Source endpoints

Allowlisted filters on the events list (anything else returns 400): limit, page_token, simulation, entity, event_type, occurred_after. This reporting family is a preview dataset. Inspect the dataset schema and data policies at GET /v1/reporting/datasets and GET /v1/reporting/datasets/simulation_events.

​

Grain

One row per reporting simulation event. A person who opened and then clicked the same message produces two rows. Events with a null entity_id (no actor / recipient / target participant) still appear — email is null. The API window is widened by one minute; the exact occurred_at >= WindowStart bound is re-applied locally so the trailing year does not depend on whether the server treats occurred_after as inclusive or exclusive. Request budget: one paginated walk of events in the window, plus one walk of entities. Always set limit = "500".

​

Column mapping

Legacy column names are from your previous provider’s export. /v1 fields are the public API names; the query aliases some of them for the report.

​

Action tokens

action is the closed reporting token. Legacy “Email Sent” maps to simulation.delivered (delivered is the public verb; the wire token is simulation.delivered). Extra fields kept because the API has them: sender_domain, full_name, event_id, entity_id, simulation_id, occurred_at, plus entity_type and entity_status from the entity join.

​

Divergences from the legacy export

• Raw IP is never available. /v1 will not expose raw client IP — privacy by design, not a pending mapping. The query does not add a placeholder IP column.
• Device type is derived, not raw. device_type is a derived device class for click, submit, and report events. Observed tokens include desktop, mobile, tablet, and unknown, but the emitter stores a free-form string — treat it as open text, not a closed enum. It is null when the event has no derived class, and the raw user_agent string stays private.
• “Email Sent” is simulation.delivered. Use that token when you filter or count sends. Do not look for a legacy email_sent string.
• Recipient email is a join, not a field on the event. The reporting event omits email; the query walks /entities to fill it.
• Trailing 12 calendar months, not a 365-day duration, and not the full history.
• Long-form, not collapsed. One row per interaction, not one result per person.

​

Next steps