Zimbra email server

[ahamed]

we have a requirement to add the Zimbra email server to fortisiem. any best practice or any method that we need to follow to integrate the Zimbra email server into the fortisiem. Thank you.

[FSM_FTNT]

Hi Ahamed, I think it will depend whether this is on premise or Cloud installation, I had a check of the on premise and looks like you will need to configure syslog to forward to FortiSIEM.

https://wiki.zimbra.com/wiki/Log_Files

There may be another step required to parser these log, but first is to get them into FortiSIEM.

Let us know how you get on.

Thanks

[Madisonsq]

is there any log parser for Zimbra?

[FSM_FTNT]

There isnt one out-the-box. Do you have some sample logs you can share?

[hajar_Tag]

Any updates ?

[FSM_FTNT]

If you can provide logs, we will investigate a parser.