Cisco Secure Email Gateway Mail Logs

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/email-cisco-secure-email-gateway/generator.yml \
  --id seg \
  --live-mode true

Event Types

Realism Features

• About 95,000 lines a day in UTC, with about 1,740 outbound and 2,300 inbound messages and 435 rejected connections. Total volume follows the working day of internal users: about 2,050 lines an hour at night, rising from 06:00 to about 6,500 an hour between 09:00 and 15:00, then falling after 16:00 to a tail until 19:00; internet mail is higher between 06:00 and 17:00 and continues at night. Users, their weights and working hours are fixed, mail volume per user changes from day to day only by random variation, and weekends look like weekdays.
• 100 internal users each have an activity weight, their own working hours in UTC and a personal mailbox at one of the freemail providers. Outbound mail comes from users in proportion to their weight, mostly within their own working hours, as single messages and series of 2-5 messages to the same recipients; about 2% of recipients are mistyped and hard-bounce. Inbound mail brings partner and freemail correspondents, newsletters marked as graymail, spam quarantined by CASE (about 210 messages a day), low-reputation connections rejected by the blocked-list sender group and a few virus drops a day. Rates and shares are synthetic, not vendor-measured.
• Every user now and then mails their own personal mailbox, singly or in quick series: about 165 such messages a day, about 23 of them 8 MB or more. A group of 22 users does this one to six times a day, the others a few times a week. Per 4 days, two large messages to the own mailbox within 40 minutes occur 5-12 times, and three or more large messages from one sender to other recipients within 40 minutes 64-100 times. Three large messages to the own mailbox within 46 minutes never occur outside episodes, a slightly wider empty margin than a real gateway would show.
• With anomaly_mode true each episode adds its own three large messages to a personal mailbox, so counts of large personal mail are about three per episode higher than in background only, while the total line count is the same in both modes; at intervals of a few hours closely spaced large messages per sender become noticeably more frequent. The gateway logs no content beyond attachment names, so the chain shows volume and destination, not intent.
• Each record keeps the raw syslog line and the fields the integration's grok patterns extract: MID, ICID, DCID, RID, sender and recipient addresses, read bytes, connection and message status, and scanning engine verdicts. Structured fields are what Elastic integration 1.29.3 extracts; its connection pattern matches only the Management interface, hence the single interface. Sender-group, antivirus, attachment, quarantine and bounce lines keep only email.message_id or the message text, as the integration leaves them, and Elastic agent fields are omitted.
• No complete raw capture of an AsyncOS 16.x appliance was available: line grammar follows the AsyncOS 16.5 Logging chapter examples and the Elastic integration fixtures, the RELAY SG ... SBRS rfc1918 line follows Cisco TechNote 214631, and the REJECT SG BLOCKED_LIST line applies the documented ACCEPT SG grammar to the default blocked sender group.
• Syslog timestamps have one-second resolution and no year, @timestamp is UTC with .000 milliseconds, and the priority is always <166> (local4.info), as in the integration fixtures. Lines the appliance writes at the same instant are spread over consecutive seconds: connection and sender-group lines share a second in 42% of connections and are at most 6 s apart in 99%. A message takes a median 28 s from Start MID to Message finished (10% under 13 s, 10% over 57 s), longer than on a real gateway, and longer at night (about 45 s) than by day (about 23 s).
• Not covered: TLS, SMTP authentication, per-connection message reuse, delayed (soft-bounce) delivery, DLP, AMP, URL filtering, message filters, Subject with double quotes and log levels other than Info. SPF, DKIM and DMARC pass for legitimate inbound senders and are not logged for spam senders.

Sample Output

{
  "@timestamp": "2026-09-01T11:55:22.000Z",
  "cisco_secure_email_gateway": {
    "log": {
      "category": {
        "name": "mail_logs"
      },
      "host": "esa-01.contoso.example",
      "message": "MID 74652742 ready 9721387 bytes from \u003cf.sergeeva@contoso.example\u003e",
      "read_bytes": 9721387
    }
  },
  "ecs": {
    "version": "8.17.0"
  },
  "email": {
    "from": {
      "address": [
        "f.sergeeva@contoso.example"
      ]
    },
    "message_id": "74652742"
  },
  "event": {
    "dataset": "cisco_secure_email_gateway.log",
    "kind": "event",
    "original": "\u003c166\u003eSep  1 11:55:22 esa-01.contoso.example mail_logs: Info: MID 74652742 ready 9721387 bytes from \u003cf.sergeeva@contoso.example\u003e",
    "timezone": "UTC"
  },
  "log": {
    "level": "info",
    "syslog": {
      "priority": 166
    }
  },
  "tags": [
    "preserve_original_event"
  ]
}

Parameters