From the admin guide, these steps need to be followed. The log above does not look like the sample in the admin guide, so it probably needs a parser adjustment if all the steps have been followed:
Syslog
- Log in to your Ironport Mail Gateway device manager with administrator privileges.
- Edit the Log Subscription settings.
- For Log Name, enter IronPort-Mail.
This identifies the log to FortiSIEM as originating from an Ironport mail gateway device.
- For Retrieval Method, select Syslog Push.
- For Hostname, enter the IP address of your FortiSIEM virtual appliance.
- For Protocol, select UDP.
Sample Parsed Ironport Mail Gateway Syslog
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: MID 200257071 ready 24663 bytes from <someone@foo.com>Sep 24 11:39:49 18.0.19.8 IronPort-Mail: Info: MID 1347076 ICID 346818 From: <john.doe@abc.com>Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Message aborted MID 200257071 Dropped by antivirus
Tue Sep 24 11:39:49 2012 IronPort-Mail: Info: Delayed: DCID 5 MID 200257071 to RID 0 - 4.1.0 - Unknown address error ('466', ['Mailbox temporarily full.'])[]-------------------------------------------
Original Message:
Sent: May 17, 2021 08:13 PM
From: Muhammad Hafiz Safwan Bin Jasmi
Subject: Cisco Iron Port - Unknown Event
Hi Guys,
One of monitoring device is Cisco Iron Port, the issue i have is it did not triggered any incident. When query the Event Type will show "Unknown event type". Any help on this issue?
Below is sample of the Raw log
<190>May 17 11:17:19 xxxxxx proxylogs: Info: PROX_AUTH : 49974500 : [2459: xxxxxxx]Login for user [APU]\[USERNAME]@[XXXX-LLM000-U] failed due to [Wrong Password]
