Parsers and Generated Fields

Tag Fields Created by Parser fortinet-fortimail

  • #Cps.version

  • #Vendor

  • #ecs.version

  • #event.dataset

  • #event.kind

  • #event.module

  • #event.outcome

  • #observer.type

Fields Identified by Parser fortinet-fortimail
Source FieldCPS FieldDescriptionMapping
Vendor.log.date, Vendor.log.time@timestampEvent timestampParsed from Vendor.log.date and Vendor.log.time using format function
Vendor.log.domaindestination.domainDestination domain nameCopied from Vendor.log.domain (lowercased)
Vendor.log.dst_ipdestination.ipDestination IP addressCopied from Vendor.log.dst_ip
Noneecs.versionECS schema versionStatic value: 8.17.0
Vendor.log.directionemail.directionEmail flow directionCopied from Vendor.log.direction
Vendor.log.fromemail.from.address[]Sender email addressExtracted from Vendor.log.from using regex patterns
Vendor.log.message_idemail.message_idEmail message identifierCopied from Vendor.log.message_id
Vendor.log.subjectemail.subjectEmail subject lineCopied from Vendor.log.subject
Vendor.log.toemail.to.addressRecipient email addressesParsed from Vendor.log.to using splitString function
Vendor.log.maileremail.x_mailerEmail client informationCopied from Vendor.log.mailer
Vendor.log.actionevent.actionAction performedCopied from Vendor.log.action when not "none" or "unknown"
Vendor.log.type, Vendor.log.subtypeevent.category[]Event categorizationArray populated based on log type and subtype conditions
event.module, Vendor.log.typeevent.datasetDataset identifierFormatted using event.module and Vendor.log.type
Vendor.log.log_idevent.idEvent identifierCopied from Vendor.log.log_id
Noneevent.kindEvent kind classificationStatic value: event
Noneevent.moduleModule nameStatic value: fortimail
Vendor.log.status, Vendor.log.msgevent.outcomeEvent outcomeDetermined based on status and message content
Vendor.log.classifierevent.reasonEvent classification reasonCopied from Vendor.log.classifier
Vendor.log.log_partevent.sequenceEvent sequence numberCopied from Vendor.log.log_part
log.levelevent.severityEvent severity scoreMapped from log.level using severity mapping
Vendor.log.type, Vendor.log.msgevent.type[]Event type classificationArray populated based on log type and message patterns
Vendor.log.prilog.levelLog priority levelCopied from Vendor.log.pri
log.syslog.priority, log.syslog.severity.codelog.syslog.facility.codeSyslog facility codeCalculated from log.syslog.priority and severity
@rawstringlog.syslog.prioritySyslog priority valueExtracted from syslog header using regex
log.levellog.syslog.severity.codeSyslog severity codeMapped from log.level using severity codes
Vendor.log.uinetwork.protocolNetwork protocolExtracted from Vendor.log.ui using regex pattern
Vendor.log.polidrule.idPolicy rule identifierCopied from Vendor.log.polid
Vendor.log.domainserver.domainServer domain nameCopied from Vendor.log.domain (lowercased)
Vendor.log.client_namesource.addressSource hostnameCopied from Vendor.log.client_name (lowercased)
Vendor.log.client_ccsource.geo.country_iso_codeSource country codeCopied from Vendor.log.client_cc
Vendor.log.client_ip, Vendor.log.src, Vendor.log.uisource.ipSource IP addressCopied from Vendor.log.client_ip or Vendor.log.src when valid IP
Vendor.log.virusthreat.indicator.nameThreat indicator nameCopied from Vendor.log.virus
url.originalurl.domainURL domain componentParsed from url.original
Vendor.log.urlurl.originalOriginal URLCopied from Vendor.log.url
Vendor.log.useruser.nameUsernameCopied from Vendor.log.user when available