Parsers and Generated Fields
Tag Fields Created by Parser fortinet-fortimail
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser fortinet-fortimail
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| Vendor.log.date, Vendor.log.time, Vendor.log.tz | @timestamp | Event timestamp | Parsed from `_timestamp` constructed by combining date, time, and optional timezone fields; format `yyyy-MM-dd'T'HH:mm:ss[.SSS]Z` with timezone offset when `Vendor.log.tz` is present, otherwise UTC |
| Vendor.log.msg | client.ip | Client IP address extracted from authserver block rule messages | Extracted from Vendor.log.msg using regex pattern `authserver: (?<event.action>\S+) block rule for (?<client.ip>\S+)` |
| Vendor.log.domain | destination.domain | Destination domain name | Copied from Vendor.log.domain and lowercased |
| Vendor.log.dst_ip | destination.ip | Destination IP address | Copied from Vendor.log.dst_ip |
| None | ecs.version | ECS schema version | Static value: 9.5.0 |
| Vendor.log.direction | email.direction | Email flow direction (in/out) | Copied from Vendor.log.direction |
| Vendor.log.from | email.from.address[] | Sender email address | Extracted from Vendor.log.from using regex to capture address within angle brackets, or directly if it contains `@`; lowercased |
| Vendor.log.message_id | email.message_id | Email message identifier | Copied from Vendor.log.message_id |
| Vendor.log.subject | email.subject | Email subject line | Copied from Vendor.log.subject |
| Vendor.log.to | email.to.address[] | Recipient email addresses | Parsed from Vendor.log.to by lowercasing and splitting on comma using splitString |
| Vendor.log.mailer | email.x_mailer | Email client information | Copied from Vendor.log.mailer |
| Vendor.log.action, Vendor.log.msg | event.action | Action performed on the event | Copied from Vendor.log.action when value does not match `none` or `unknown`; also extracted from Vendor.log.msg for authserver block rule events |
| Vendor.log.type, Vendor.log.subtype, Vendor.log.msg | event.category[] | Event categorization array | Array populated based on log type and subtype conditions across all case branches |
| event.module, Vendor.log.type | event.dataset | Dataset identifier | Formatted as `event.module.Vendor.log.type` using format function |
| Vendor.log.log_id | event.id | Unique event identifier | Copied from Vendor.log.log_id |
| None | event.kind | Event kind classification | Static value: event |
| None | event.module | Module name | Static value: fortimail |
| Vendor.log.status, Vendor.log.msg | event.outcome | Outcome of the event | Determined based on Vendor.log.status value, or Vendor.log.msg content matching fail/error/timed out patterns; defaults to success |
| Vendor.log.classifier | event.reason | Classification reason for the event | Copied from Vendor.log.classifier |
| Vendor.log.log_part | event.sequence | Log sequence number | Copied from Vendor.log.log_part |
| Vendor.log.pri (indirect via log.level) | event.severity | Numeric severity score | Mapped from log.level: emergency=100, alert=90, critical=75, error=60, warning=45, notice=30, information=15, debug=0 |
| Vendor.log.type, Vendor.log.subtype, Vendor.log.msg | event.type[] | Event type classification array | Array populated based on log type, subtype, and message pattern conditions |
| Vendor.log.pri | log.level | Log priority level as text | Copied from Vendor.log.pri |
| log.syslog.priority, log.syslog.severity.code | log.syslog.facility.code | Syslog facility code | Calculated as `floor((log.syslog.priority - log.syslog.severity.code) / 8)` |
| @rawstring | log.syslog.priority | Syslog priority value | Extracted from syslog header using regex `^\<(?<log.syslog.priority>\d+)\>` |
| Vendor.log.pri (indirect via log.level) | log.syslog.severity.code | Syslog severity code | Mapped from log.level: emergency=0, alert=1, critical=2, error=3, warning=4, notice=5, information=6, debug=7 |
| Vendor.log.ui | network.protocol | Network protocol extracted from UI field | Extracted from Vendor.log.ui using regex pattern `(?<network.protocol>\S+)\((?<source.ip>.*)\)` |
| Vendor.log.polid | rule.id | Policy rule identifier | Copied from Vendor.log.polid |
| Vendor.log.domain | server.domain | Server domain name | Copied from Vendor.log.domain and lowercased |
| Vendor.log.client_name | source.address | Source hostname | Copied from Vendor.log.client_name and lowercased |
| Vendor.log.client_cc | source.geo.country_iso_code | Source country ISO code | Copied from Vendor.log.client_cc |
| Vendor.log.client_ip, Vendor.log.src, Vendor.log.ui, Vendor.log.msg | source.ip | Source IP address | Copied from Vendor.log.client_ip when valid IP (checked via cidr); falls back to Vendor.log.src when valid IP; also extracted from Vendor.log.ui via regex, and from Vendor.log.msg for admin/webmail login events |
| Vendor.log.virus | threat.indicator.name | Threat indicator name (virus name) | Copied from Vendor.log.virus |
| Vendor.log.url (indirect via url.original) | url.domain | Domain component of the URL | Parsed from url.original by renaming url.host after parseUrl |
| Vendor.log.url | url.original | Original URL string | Copied from Vendor.log.url |
| Vendor.log.msg, Vendor.log.user | user.name | Username associated with the event | Extracted from Vendor.log.msg via regex for admin/webmail login events; copied from Vendor.log.user when user.name is not already set; extracted from kevent/config messages via regex `by user (?<user.name>\S+)` |