Cisco Ironport¶
Description¶
Constructor : Cisco
Product : Ironport
Theoretical injector performance¶
N/A
Log sample¶
1 | mail_logs_syslog_ELK: Info: MID 23902 RID [0] Response '2.6.0 <mail@mail.com> [InternalId=7796850] Queued mail for delivery' |
1 | mail_logs_syslog_ELK: Info: Message finished MID 23902 done |
1 | mail_logs_syslog_ELK: Info: Delivery start DCID 15291 MID 23904 to RID [0] |
1 | mail_logs_syslog_ELK: Info: Message done DCID 15292 MID 23903 to RID [0] |
1 | mail_logs_syslog_ELK: Info: New SMTP ICID 27359 interface Data 1 (127.0.0.1) address 127.0.0.1 reverse dns host deliver04.zonnet.isp-net.nl verified yes |
Normalized fields¶
| LMC field | Field normalization |
|---|---|
| [alarm][sev] | |
| [alarm][name] | |
| [app][proto][name] | |
| [action] | |
| [init][usr][mail] | |
| [init][host][name] | |
| [init][host][ip] | |
| [init][host][port] | |
| [init][process][name] | |
| [target][usr][mail] | |
| [target][host][name] | |
| [target][host][ip] | |
| [target][host][port] | |
| [target][process][name] | |
| [cisco][ironport][id] | |
| [cisco][ironport][pid] | |
| [cisco][ironport][rid] | |
| [cisco][ironport][dcid] | |
| [cisco][ironport][icid] | |
| [cisco][ironport][mid] | |
| [cisco][ironport][subject] | |
| [cisco][ironport][bytes] | |
| [cisco][ironport][recipients] | |
| [cisco][ironport][reason] | |
| [cisco][ironport][status] | |
| [cisco][ironport][version] |