Skip to main content
Skip table of contents

Message Tracking Event

Vendor Documentation


Rule Name

Rule Type


Common Event

Message Tracking EventBase RuleInformation General Tracking Log
Message Tracking Event : Message QuarantinedSub RuleFailed ActivityQuarantined Message
Message Tracking Event : Message DeliveredSub RuleInformationMessage Delivered
Message Tracking Event : Message Delivery UnsuccessfulSub RuleError

Message Delivery Failed

Message Tracking Event : Message Processing CompletedSub RuleActivityGeneral Threat Message
Message Tracking Event : Message DeletedSub RuleInformationQuarantined Message Deleted

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Header (logVer)N/AN/ACEF format version
Header (vendor)N/AN/AAppliance vendor
Header (pname)N/AN/AAppliance product
Header (pver)N/AN/AAppliance version
Header (eventid)N/AN/ASignature ID
Header (eventName)<vendorinfo>Text/StringDescription
Header (severity)<severity>NumberSeverity
cs1N/AN/AEmail ID
cs1LabelN/AN/AEmail ID label
cs2N/AN/AInternal Email ID
cs2LabelN/AN/AInternal Email ID label
  • Quarantined
  • Delivered
  • Delivery unsuccessful
  • Processing completed
  • Deleted
cs3LabelN/AN/ALatest status label
cs4N/AN/ASender email address
cs4LabelN/AN/ASender email address label
cs5N/AN/ARecipient email address
cs5LabelN/AN/ARecipient email address label
cs6<status>Text/StringProcess history
cs6LabelN/AN/AProcess history label
destinationTranslatedAddressN/AN/ARelay MTA IP address
deviceExternalIdN/AN/AAppliance GUID
duser<recipient>Text/StringEmail recipients
dvcN/AN/AAppliance IP address
dvchostN/AN/AAppliance host name
dvcmacN/AN/AAppliance MAC address
msg<subject>Text/StringEmail subject
reason<reason>Text/StringReason for block action
rtN/AN/ALog generation time
Format: Unix time stamp (number of milliseconds since Jan 01 1970 UTC)
src<sip>IPSource IP address
suser<sender>Text/StringEmail sender
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.