Cybersecurity Forum

This forum is for all security enthusiasts to discuss Fortinet's latest & evolving technologies and to connect & network with peers in the cybersecurity hemisphere. Share and learn on a broad range of topics like best practices, use cases, integrations and more. For support specific questions/resources, please visit the Support Forum or the Knowledge Base.

New Contributor

Cisco Iron Port - Unknown Event

Hi Guys,

One of monitoring device is Cisco Iron Port, the issue i have is it did not triggered any incident. When query the Event Type will show "Unknown event type". Any help on this issue?

Below is sample of the Raw log

<190>May 17 11:17:19 xxxxxx proxylogs: Info: PROX_AUTH : 49974500 : [2459: xxxxxxx]Login for user [APU]\[USERNAME]@[XXXX-LLM000-U] failed due to [Wrong Password]

New Contributor III

From the admin guide, these steps need to be followed.  The log above does not look like the sample in the admin guide, so it probably needs a parser adjustment if all the steps have been followed: 
  1. Log in to your Ironport Mail Gateway device manager with administrator privileges. 
  2. Edit the Log Subscription settings.
  3. For Log Name, enter IronPort-Mail.
    This identifies the log to FortiSIEM as originating from an Ironport mail gateway device. 
  4. For Retrieval Method, select Syslog Push
  5. For Hostname, enter the IP address of your FortiSIEM virtual appliance.
  6. For Protocol, select UDP
Sample Parsed Ironport Mail Gateway Syslog

Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: MID 200257071 ready 24663 bytes from <>Sep 24 11:39:49 IronPort-Mail: Info: MID 1347076 ICID 346818 From: <>Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Message aborted MID 200257071 Dropped by antivirus
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Delayed: DCID 5 MID 200257071 to RID 0 - 4.1.0 - Unknown address error ('466', ['Mailbox temporarily full.'])[]


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.