Cisco Iron Port - Unknown Event

[HafizJasmi]

Hi Guys,

One of monitoring device is Cisco Iron Port, the issue i have is it did not triggered any incident. When query the Event Type will show "Unknown event type". Any help on this issue?

Below is sample of the Raw log

<190>May 17 11:17:19 xxxxxx proxylogs: Info: PROX_AUTH : 49974500 : [2459: xxxxxxx]Login for user [APU]\[USERNAME]@[XXXX-LLM000-U] failed due to [Wrong Password]

[KarnGriffen]

From the admin guide, these steps need to be followed.  The log above does not look like the sample in the admin guide, so it probably needs a parser adjustment if all the steps have been followed: 

Syslog

1. Log in to your Ironport Mail Gateway device manager with administrator privileges. 
2. Edit the Log Subscription settings.
3. For Log Name, enter IronPort-Mail.
   This identifies the log to FortiSIEM as originating from an Ironport mail gateway device. 
4. For Retrieval Method, select Syslog Push. 
5. For Hostname, enter the IP address of your FortiSIEM virtual appliance.
6. For Protocol, select UDP. 

Sample Parsed Ironport Mail Gateway Syslog

Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: MID 200257071 ready 24663 bytes from <someone@foo.com>Sep 24 11:39:49 18.0.19.8 IronPort-Mail: Info: MID 1347076 ICID 346818 From: <john.doe@abc.com>Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Message aborted MID 200257071 Dropped by antivirus
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Delayed: DCID 5 MID 200257071 to RID 0 - 4.1.0 - Unknown address error ('466', ['Mailbox temporarily full.'])[]