examples/phishing_headers.json

{
 "model": "jue-latest",
 "state": {
  "headers": {
   "From": "\"Microsoft 365 Security\" <no-reply@micros0ft-secure.com>",
   "Reply-To": "it-helpdesk@protonmail.example",
   "Authentication-Results": "mx.corp.example; spf=fail smtp.mailfrom=micros0ft-secure.com; dkim=none; dmarc=fail header.from=micros0ft-secure.com",
   "Subject": "Action required: your mailbox will be suspended in 24 hours"
  },
  "body_excerpt": "Click https://micros0ft-secure.com/verify to keep your account active."
 },
 "questions": {
  "verdict": {
   "type": "choice",
   "instructions": "Triage verdict for this email.",
   "criteria": {
    "PHISHING": "Credential phishing",
    "SPAM": "Unsolicited marketing",
    "BENIGN": "Legitimate email"
   }
  },
  "dmarc_aligned": {
   "type": "noul",
   "instructions": "The message passes DMARC alignment."
  }
 }
}