Examples - xorlab

Log detailed email results

Records the complete result of the email analysis in JSON format to a remote Syslog server. For a step-by-step Syslog guide, see Enable Logging via Syslog.

Event: trace.msg_analysis.complete
Container: MTA core
File Path: activeguard/core/logback-audit.xml
Appender: SyslogAppender
Formatting: %coreJsonMsg%n

File Path: activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>

<included>
 
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>
 
  <!-- Log once for each message when the processing has finished -->
  <logger name="trace.msg_analysis.complete">
     <appender-ref ref="syslogAppender"/>
  </logger>
 
</included>

Log audit events

Send audit events in JSON format to a remote Syslog server each time a user does an action in the XCC web interface. For a step-by-step Syslog guide, see Enable Logging via Syslog.

Event: audit (includes sub-categories)
Container: XCC backend
File path: xcc/backend/logback-audit.xml
Appender: SyslogAppender
Formatting: %jsonMsg%n

File Path: xcc/backend/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log all user audit events -->
  <logger name="audit">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

In order to also log successful and failed logins, configure auth/auth/logback-audit.xml as well with the same parameters as above.

Log SMTP email traces

Send a JSON message when an email has been accepted through SMTP and another when a delivery attempt has been made. For a step-by-step Syslog guide, see Enable Logging via Syslog.

Events: trace.mta.received, trace.mta.send
Container: Mta
File path: activeguard/mta/audit/logback-audit.xml
Appender: syslogAppender
Format: %jsonMsg%n

File Path: activeguard/mta/audit/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>192.168.1.100</syslogHost>
    <port>514</port>
    <hostName>xorlabhostname</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log received and send SMTP events. Alternatively, you can name a single logger 'trace.mta'. -->
  <logger name="trace.mta.received">
    <appender-ref ref="syslogAppender"/>
  </logger>
  <logger name="trace.mta.send">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

How to log all SMTP logsIf you want to log the complete SMTP log and not only the send and receive events, then replace the name of the first logger with trace.mta and remove the second logger completely.

If you want to correlate the SMTP queue ID from the two events above with the GGRID, you can additionally activate the following log event.

Event: trace.msg_delivered
Container: Core
File path: activeguard/core/logback-audit.xml
Appender: syslogAppender
Format: %jsonMsg%n

File Path: activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>192.168.1.100</syslogHost>
    <port>514</port>
    <hostName>xorlabhostname</hostName>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log the queue ID, which can be used to correlate with the trace.mta.send event -->
  <logger name="trace.msg_delivered">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

Log detailed email results per verdict

The following configuration ensures that a JSON message is sent each time a verdict is made on an email. This setup is particularly useful in scenarios where:

An email initially appears legitimate and is delivered to the user, but
A delayed or offline Sandbox scan later updates the verdict from benign to malicious.

In such cases, the configuration below would generate two separate JSON messages for the same email—one for each verdict, reflecting the change in status.

Event: trace.msg_verdict
Container: Core
File path: activeguard/core/logback-audit.xml
Appender: syslogAppender
Format: %coreJsonMsg%n

File Path: activeguard/core/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <appender name="syslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%coreJsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log the trace.msg_verdict event -->
  <logger name="trace.msg_verdict">
    <appender-ref ref="syslogAppender"/>
  </logger>
</included>

Log threat intelligence

The following configuration will write one JSON message for every domain threat intelligence event into a local file and also logs the event over syslog:

Event: ti.domain
Container: Backend
File path: xcc/backend/logback-audit.xml
Appenders: syslogAppender, RollingFileAppender
Format: %jsonMsg%n

xorlab on-prem onlyWriting to local files is only supported for xorlab on-premises.

File Path: xcc/backend/logback-audit.xml

<?xml version="1.0" encoding="UTF-8"?>
<included>
  <!-- Write logs into a local file with a rollover policy -->
   <appender name="threatIntelFileAppender" class="ch.qos.logback.core.rolling.RollingFileAppender">
     <file>${log_dir}/domain_ti_json.log</file>
     <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
       <!-- roll over daily -->
       <fileNamePattern>${log_dir}/domain_ti_json_%d{yyyy-MM-dd}.%i.log.zip</fileNamePattern>
       <maxFileSize>100MB</maxFileSize>
       <!-- total (compressed) size of all parts  -->
       <totalSizeCap>500MB</totalSizeCap>
       <!-- Number of roll overs to keep -->
       <maxHistory>60</maxHistory>
     </rollingPolicy>
     <encoder>
       <pattern>%jsonMsg%n</pattern>
     </encoder>
   </appender>
  
  <appender name="threatIntelSyslogAppender" class="com.xorlab.sgappliance.shared.logback.SyslogAppender">
    <syslogHost>syslog.example.com</syslogHost>
    <port>514</port>
    <protocol>UDP</protocol>
    <facility>LOCAL0</facility>
    <encoder>
      <pattern>%jsonMsg%n</pattern>
    </encoder>
  </appender>

  <!-- Log all ti.domain events -->
  <logger additivity="false" level="debug" name="ti.domain">
    <appender-ref ref="threatIntelFileAppender"/>
    <appender-ref ref="threatIntelSyslogAppender"/>
  </logger> 
</included>

​Log detailed email results

​Log audit events

​Log SMTP email traces

​Log detailed email results per verdict

​Log threat intelligence

Log detailed email results

Log audit events

Log SMTP email traces

Log detailed email results per verdict

Log threat intelligence