FortiMail logs
FortiAnalyzer supports normalizing FortiMail logs as Fabric logs.
The following field mapping applies:
|
FortiMail Log Field |
Normalized Fabric Log Field |
|---|---|
| devid,device_id | data_sourceid |
| concat_data_source_name | data_sourcename |
| data_timestamp | data_timestamp |
| dst_ip | dst_ip |
| concat_eventaction,disposition | event_action |
| logid,log_id | event_id |
| msg | event_message |
| polid | event_policy |
| classifier | event_profile |
| event_message | event_ref |
| pri | event_severity |
| subtype | event_subtype |
| type | event_type |
| file_hash | file_hash |
| file_hash_type | file_hashtype |
| file_name | file_name |
| host_classification | host_classification |
| host_hwvendor | host_hwvendor |
| host_hwver | host_hwver |
| host_ip | host_ip |
| host_mac | host_mac |
| host_name | host_name |
| host_osname | host_osname |
| host_osver | host_osver |
| host_type | host_type |
| from | mail_from |
| message_length | mail_size |
| subject | mail_subject |
| to | mail_to |
| direction | net_direction |
| session_id | net_sessionid |
| client_name | src_domain |
| location | src_geo |
| client_ip | src_ip |
| threat_name | threat_name |
| threat_pattern | threat_pattern |
| ui,domain_name | user_domain |
| user,user_name | user_id |