Choose What to Log

Nothing is forwarded off the platform until you name the events you want. Decide that first: the event determines which configuration file you edit.

Start from a goal

Each row is a complete answer: the events, the format, and the component whose logback-audit.xml you edit. The directories behind the container names are in How Logging Works.

Goal	Events	Format	Container
One rich record per email: verdict, sender, recipients, tags, scores, attachment hashes, extracted URLs	`trace.msg_analysis.complete`	JSON extended	`Core`
Every verdict decision, including a verdict that changes later because a Sandbox scan finished out of band	`trace.msg_verdict`	JSON extended	`Core`
SMTP mail flow tracing: what was accepted, what was relayed, with queue IDs	`trace.mta.received`, `trace.mta.send`	JSON	`Mta`
Correlate an SMTP queue ID with the email’s GGRID	`trace.msg_delivered`	JSON	`Core`
Full analyst and admin audit trail: message views, downloads, releases, list and campaign changes, config changes	`audit`	JSON	`Backend`
Successful and failed logins	`audit.access`	JSON	`Auth`
Quarantine release workflow: who requested, approved, or denied	`audit.quarantine.release.request`	JSON	`Backend`
Emails evicted from a mailbox by case isolation	`audit.isolate.removed`	JSON	`Backend`
Threat intelligence extracted from your own mail	`ti.email`, `ti.ip`, `ti.file`, `ti.domain`, `ti.url`	JSON	`Backend`
Backup success and failure	`sys.backup`	JSON	`Backend`
Platform lifecycle: startup, shutdown, configuration commits	`sys`	JSON	any

The most common starting pointForward trace.msg_analysis.complete with the extended JSON format. That is one record per email carrying the full analysis result, which is what most email dashboards and correlation rules are built on. The complete file is in Configuration Examples.

The full catalog, with event IDs, severities, and the container that emits each one, is Log Events. Names are prefixes, so audit in the table above means every audit.* event. See Names are prefixes.

Choose a payload format

The format is a pattern inside the appender, so you can use any of these with any channel. No action is needed yet; you fill it into the appender in the channel guide.

JSON

Default. Works for every event, and records that event’s own attributes.

<pattern>%jsonMsg%n</pattern>

JSON extended

The complete result of the email analysis as a single record.

<pattern>%coreJsonMsg%n</pattern>

Message-tracing (trace.*) events only.

CEF

ArcSight-style Common Event Format. Works for every event. Pick it when your platform expects CEF.

<pattern>%cef%n</pattern>

Single attributes

A few named fields instead of the whole record, for a lookup table or a compact alert.

<pattern>%logArg{item} %logArg{listName}%n</pattern>

Next step

Pick the channel that carries the events you chose.

Forward Events over Syslog

A SIEM, a log collector, or any Syslog listener.

Send an Email When an Event Occurs

A mail per event, for rare events.

Write Events to a Log File

A rolling file on the xorlab host. On-premises only.

​Start from a goal

​Choose a payload format

JSON

JSON extended

CEF

Single attributes

​Next step

Forward Events over Syslog

Send an Email When an Event Occurs

Write Events to a Log File

Start from a goal

Choose a payload format

Next step