Cisco Secure Email Events
Vendor Documentation
| https://www.cisco.com/c/en/us/td/docs/security/esa/esa14-0/user_guide/b_ESA_Admin_Guide_14-0/b_ESA_Admin_Guide_12_1_chapter_0100111.html |
| https://docs.ces.cisco.com/docs/single-log-line-sll |
Classification
| Rule Name | Rule Type | Classification | Common Event |
|---|---|---|---|
| Cisco Secure Email Events | Base Rule | Information | General AlertEmail |
| Cisco Secure Email Delivered | Sub Rule | Information | Email Delivered |
| Cisco Secure Email Dropped | Sub Rule | Information | Message Dropped |
| Cisco Secure Email Bounced | Sub Rule | Warning | Email Message Bounced |
| Cisco Secure Email Quarantined | Sub Rule | Failed Activity | Quarantined Message |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
|---|---|---|---|
| N/A | N/A | N/A | CEF format version |
| N/A | N/A | N/A | Appliance vendor |
| N/A | <vendorinfo> | String | Appliance product |
| N/A | <version> | Text/String | Appliance version |
| N/A | <vmid> | String | Event Class ID |
| N/A | N/A | N/A | Event Name |
| N/A | <severity> | Number | Severity |
| deviceExternalId | <serialnumber> | Text/String | Serial Number |
| ESAMID | N/A | N/A | N/A |
| ESAICID | N/A | N/A | ICID |
| ESAAMPVerdict | N/A | N/A | AMP Verdict |
| ESAASVerdict | N/A | N/A | AS Verdict |
| ESAAVVerdict | N/A | N/A | AV Verdict |
| ESACFVerdict | N/A | N/A | Content Filters Verdict |
| endTime | N/A | N/A | DCID Timestamp |
| ESADLPVerdict | N/A | N/A | DLP Verdict |
| dvc | N/A | N/A | Data IP |
| ESAFriendlyFrom | N/A | N/A | Friendly From |
| ESAGMVerdict | N/A | N/A | Graymail Verdict |
| startTime | N/A | N/A | ICID Timestamp |
| deviceInboundInterface | N/A | N/A | Listener Name |
| deviceDirection | N/A | N/A | Mail Direction |
| ESAMailFlowPolicy | <policy> | String | Mail Flow Policy Name |
| suser | <sname> | Text/String | Mail From |
| cs1Label | N/A | N/A | Message ID |
| cs1 | N/A | N/A | Mail Policy Name |
| cs2Label | N/A | N/A | N/A |
| cs2 | N/A | N/A | Mail Sender Geo Location |
| ESAMFVerdict | N/A | N/A | N/A |
| act | <action> <tag1> | String | Message Final Action |
| cs4Label | N/A | N/A | N/A |
| cs4 | N/A | N/A | Message ID |
| ESAOFVerdict | N/A | N/A | Outbreak Filters Verdict |
| duser | <dname> | String | Recipients |
| ESAHeloDomain | <domainimpacted> | String | Remote Host/ Helo Domain |
| ESAHeloIP | <dip> | IP Address | Remote IP/Helo Domain IP |
| ESAReplyTo | <sender> | String | Reply-To |
| cfp1Label | N/A | N/A | SBRS Score |
| cfp1 | N/A | N/A | N/A |
| ESASDRDomainAge | N/A | N/A | SDR Consolidated Domain Age |
| cs3Label | <threatname> | Text/String | SDR Consolidated Threat Category |
| cs3 | N/A | N/A | N/A |
| cs6Label | N/A | N/A | SDR Reputation Score |
| cs6 | N/A | N/A | N/A |
| ESASPFVerdict | N/A | N/A | SPF Verdict |
| sourceHostName | <domainorigin> | String | Sender Domain |
| ESASenderGroup | <group> | String | N/A |
| sourceAddress | <sip> | IP Address | Sender IP |
| msg | <subject> | String | Subject |
| ESATLSInCipher | N/A | N/A | TLS Incoming Cipher |
| ESATLSInConnStatus | <result> | Text/String | TLS Incoming Connection Status |
| ESATLSInProtocol | N/A | N/A | TLS Incoming Protocol |
| ESATLSOutCipher | N/A | N/A | TLS Outgoing Cipher |
| ESATLSOutConnStatus | <status> | Text/String | TLS Outgoing Connection Status |
| ESATLSOutProtocol | <protname> | String | TLS Outgoing Protocol |