Kaspersky Secure Mail Gateway

Kaspersky Secure Mail Gateway (KSMG) ScanLogic events — anti-virus, anti-spam, anti-phishing, content filtering, mail authentication (SPF/DKIM/DMARC), KATA integration, message backup, and scan failure events in ECS-compatible JSON.

View on GitHub

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/email-kaspersky-ksmg/generator.yml \
  --id email-kaspersky-ksmg \
  --live-mode true

Event Types

Event ID	Description	Frequency	Category
av-scan	Anti-Virus scan results (clean, infected, disinfected, encrypted)	25%	email
as-scan	Anti-Spam scan results (clean, spam, probable spam, mass mail)	25%	email
ap-scan	Anti-Phishing scan results (clean, phishing, malicious links)	15%	email
ma-auth	Mail Authentication checks (SPF/DKIM/DMARC)	15%	email
cf-filter	Content Filtering (banned files, size violations)	10%	email
kt-kata	KATA integration (APT/zero-day detection)	4%	email
message-backup	Message quarantine events	4%	email
not-processed	Scan failure events (errors, timeouts)	2%	email

Realism Features

Weighted scan outcomes per module — e.g., AV: 93.5% clean, 3% infected, 1% disinfected, 2% encrypted
Directional email flow — 72% inbound from external domains, 28% outbound from internal users
Lognormal message sizes with realistic distribution (500 B to 30 MB)
Categorized subjects tied to scan type — spam/phishing subjects for AS/AP, business subjects for others
Threat database with realistic Kaspersky detection names (Trojan, Exploit, Ransomware, Stealer)
Processing rule engine with weighted rule selection and configurable actions

Sample Output

{
  "@timestamp": "2026-03-06T14:22:31.000Z",
  "event": {
    "kind": "event",
    "category": [
      "email"
    ],
    "type": [
      "info"
    ],
    "action": "scan-result",
    "outcome": "failure",
    "severity": 7,
    "reason": "ThreatDetected"
  },
  "observer": {
    "vendor": "Kaspersky",
    "product": "Secure Mail Gateway",
    "version": "2.0.1.6960",
    "hostname": "ksmg-node01",
    "ip": [
      "10.1.0.20"
    ]
  },
  "email": {
    "direction": "inbound",
    "from": {
      "address": [
        "jdoe@partner-corp.com"
      ]
    },
    "to": {
      "address": [
        "d.brown@corp.example.com"
      ]
    },
    "subject": "Updated invoice attached"
  },
  "kaspersky": {
    "ksmg": {
      "event_class": "LMS_EV_SCAN_LOGIC_AV_STATUS",
      "scan_type": "av",
      "status": "Infected",
      "action": "Reject",
      "threat_name": "HEUR:Trojan.Script.Generic",
      "threat_file": "invoice_2024.pdf.exe"
    }
  }
}

Parameters

Parameter	Default	Description
ksmg_hostname	ksmg-node01	KSMG gateway hostname
ksmg_ip	10.1.0.20	KSMG gateway IP address
domain	corp.example.com	Organization email domain
ksmg_version	2.0.1.6960	KSMG software version
agent_id	c4d5e6f7-...	Elastic Agent UUID
agent_version	8.17.0	Elastic Agent version

Related Generators

Microsoft Exchange Message Tracking

Exchange Server 2019 message tracking — SMTP receive/send, mailbox delivery, transport routing, shadow redundancy, anti-spam filtering, distribution group expansion, and delivery failure DSNs.

Fortinet FortiMail

FortiMail email security gateway — mail statistics, SMTP protocol events, antispam verdict (clean/spam/phishing), antivirus scanning with quarantine actions, and system administration logs.

Postfix SMTP Submission Syslog

Postfix 3.8.3+ submission-relay messages from smtpd, cleanup, qmgr and smtp as parsed ECS JSON with the native syslog line in event.original, for testing mail-server authentication and outbound-mail detections. About 54,700 records and 10,100 messages a day from 150 staff users on a UTC working-day curve and eight application accounts around the clock; every accepted submission is followed from queue creation to removal. Recurring episodes show one staff user failing SASL LOGIN three times, then submitting a message for five external recipients.