# MaliciousEntity

- [JSON representation](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MaliciousEntity#SCHEMA_REPRESENTATION)
- [User](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MaliciousEntity#User)
  - [JSON representation](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MaliciousEntity#User.SCHEMA_REPRESENTATION)

Entity whose actions triggered a Gmail phishing alert.

| JSON representation |
|---|
| ``` { "entity": { object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MaliciousEntity#User`) }, "fromHeader": string, "displayName": string } ``` |

| Fields ||
|---|---|
| `entity` | ``object (`https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/MaliciousEntity#User`)`` The actor who triggered a gmail phishing alert. |
| Union field `entity_type`. Every malicious entity could only belongs to one entity type. `entity_type` can be only one of the following: ||
| `fromHeader` | `string` The sender email address. |
| `displayName` | `string` The header from display name. |

## User

A user.

| JSON representation |
|---|
| ``` { "emailAddress": string, "displayName": string } ``` |

| Fields ||
|---|---|
| `emailAddress` | `string` Email address of the user. |
| `displayName` | `string` Display name of the user. |