Configuration Examples

Every example below is a whole file. Paste it into the directory it names, change the destination, and click Publish — the logging configuration becomes active within about one minute. Then confirm it works with Verify and Troubleshoot Logging.

Goal	File to edit
Log detailed email results	`activeguard/core/logback-audit.xml`
Log audit events	`xcc/backend/logback-audit.xml`
Log SMTP email traces	`activeguard/mta/audit/logback-audit.xml`
Log detailed email results per verdict	`activeguard/core/logback-audit.xml`
Log threat intelligence	`xcc/backend/logback-audit.xml`
Mail a quarantine release request	`xcc/backend/logback-audit.xml`

If a file already exists in that directory, merge the appender and logger elements into it rather than replacing it. A new logger can reference an appender that is already in the file, so there is no need for a second one.

Log detailed email results

One record per email carrying the complete analysis result, sent to a remote Syslog server. This is the configuration most SIEM projects start from.

Setting	Value
Event	`trace.msg_analysis.complete`
Container	`Core`
Appender	`SyslogAppender`
Format	`%coreJsonMsg%n`

activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>

<included>

  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log once for each message when the processing has finished -->
  <logger name="trace.msg_analysis.complete">
     <appender-ref ref="syslogAppender"/>
  </logger>

</included>

Extended JSON records exceed the 1500-byte UDP limit and are truncated. For this example in particular, switch to TCP or TLS.

Log audit events

Every action an analyst or admin takes in XCC, in JSON, to a remote Syslog server. The logger name is the prefix audit, so it covers all of the sub-categories.

Setting	Value
Events	`audit` and everything below it
Container	`Backend`
Appender	`SyslogAppender`
Format	`%jsonMsg%n`

xcc/backend/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log all user audit events -->
  <logger name="audit">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

Logins are missing from this oneSuccessful and failed logins are emitted by the Auth container, not by Backend. Put the same file in auth/auth/ as well to capture audit.access.*.

Log SMTP email traces

One JSON record when an email is accepted over SMTP, and another for each delivery attempt. This is the mail flow view, for checking whether an email reached xorlab and whether xorlab handed it on.

Setting	Value
Events	`trace.mta.received`, `trace.mta.send`
Container	`Mta`
Appender	`SyslogAppender`
Format	`%jsonMsg%n`

activeguard/mta/audit/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>192.168.1.100</syslogHost>
    <port>514</port>
    <hostName>xorlabhostname</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log received and send SMTP events. Alternatively, you can name a single logger 'trace.mta'. -->
  <logger name="trace.mta.received">
    <appender-ref ref="syslogAppender"/>
  </logger>
  <logger name="trace.mta.send">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

How to log all SMTP logsTo forward the complete SMTP log rather than the accept and relay events only, replace the name of the first logger with trace.mta and remove the second logger. That is the whole Postfix activity log, so check the volume first.

Correlate the queue ID with the GGRID

The two events above carry the SMTP queue ID. To join it to the email’s GGRID, the identifier used by XCC and the analysis, add this event on the Core container as well.

Setting	Value
Event	`trace.msg_delivered`
Container	`Core`
Appender	`SyslogAppender`
Format	`%coreJsonMsg%n`

activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>192.168.1.100</syslogHost>
    <port>514</port>
    <hostName>xorlabhostname</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log the queue ID, which can be used to correlate with the trace.mta.send event -->
  <logger name="trace.msg_delivered">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

Log detailed email results per verdict

A record every time a verdict is reached, rather than once per email. The case this exists for:

An email looks legitimate and is delivered, but
a delayed or offline Sandbox scan later changes the verdict from benign to malicious.

You then get two records for the same email, one per verdict, so the change of status is visible in the SIEM instead of being overwritten.

Setting	Value
Event	`trace.msg_verdict`
Container	`Core`
Appender	`SyslogAppender`
Format	`%coreJsonMsg%n`

activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log the trace.msg_verdict event -->
  <logger name="trace.msg_verdict">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

Log threat intelligence

One JSON record per malicious domain observed in your own mail, written to a local file and sent over Syslog. It is also the example to copy for sending any event to two destinations at once, and the only one here that needs additivity.

Setting	Value
Event	`ti.domain`
Container	`Backend`
Appenders	`RollingFileAppender`, `SyslogAppender`
Format	`%jsonMsg%n`

On-premises onlyWriting to local files is only supported for xorlab on-premises. On a hosted deployment, keep the Syslog appender and drop the file appender.

xcc/backend/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <!-- Write logs into a local file with a rollover policy -->
   <appender name="threatIntelFileAppender" class="ch.qos.logback.core.rolling.RollingFileAppender">
     <file>${log_dir}/domain_ti_json.log</file>
     <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
       <!-- roll over daily -->
       <fileNamePattern>${log_dir}/domain_ti_json_%d{yyyy-MM-dd}.%i.log.zip</fileNamePattern>
       <maxFileSize>100MB</maxFileSize>
       <!-- total (compressed) size of all parts  -->
       <totalSizeCap>500MB</totalSizeCap>
       <!-- Number of roll overs to keep -->
       <maxHistory>60</maxHistory>
     </rollingPolicy>
     <encoder>
       <pattern>%jsonMsg%n</pattern>
     </encoder>
   </appender>

  <appender name="threatIntelSyslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log all ti.domain events -->
  <logger additivity="false" level="debug" name="ti.domain">
    <appender-ref ref="threatIntelFileAppender"/>
    <appender-ref ref="threatIntelSyslogAppender"/>
  </logger>
</included>

For the other indicator types, add a logger for ti.email, ti.ip, ti.file, and ti.url referencing the same appenders — or use the prefix ti for all of them. What each one carries is in Connect a SIEM.

​Log detailed email results

​Log audit events

​Log SMTP email traces

​Correlate the queue ID with the GGRID

​Log detailed email results per verdict

​Log threat intelligence

Log detailed email results

Log audit events

Log SMTP email traces

Correlate the queue ID with the GGRID

Log detailed email results per verdict

Log threat intelligence