https://community.splunk.com/t5/Splunk-Enterprise-Security/Issue-with-CIM-Mapping-for-ES/m-p/469390#M7106 <P>I am receiving the EMail logs from Proofpoint Email gateway via syslog. The single email communication include the multiple logs and we can use the one transaction id to create the full events which include the full email communication details.</P> <P>As this meaningful event can be generated through correlation of transcation id, how can i map this event with CIM and add the necessary tag? </P> Tue, 24 Dec 2019 07:52:58 GMT mustafag 2019-12-24T07:52:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Issue-with-CIM-Mapping-for-ES/m-p/469390#M7106 <P>I am receiving the EMail logs from Proofpoint Email gateway via syslog. The single email communication include the multiple logs and we can use the one transaction id to create the full events which include the full email communication details.</P> <P>As this meaningful event can be generated through correlation of transcation id, how can i map this event with CIM and add the necessary tag? </P> Tue, 24 Dec 2019 07:52:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Issue-with-CIM-Mapping-for-ES/m-p/469390#M7106 mustafag 2019-12-24T07:52:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Issue-with-CIM-Mapping-for-ES/m-p/469391#M7107 <P>Generally the TA should means to extract required eventtype (s) to map to Email data model. If it isn't and you are writting custom TA or updating existing TA, I would suggest not combine all events to get full email transaction, but have one or more events only for inbound email and one or more outbound. This way you can create eventtypes for inbound and outbound and then map them to Email datamodel. </P> Mon, 24 Feb 2020 14:16:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Issue-with-CIM-Mapping-for-ES/m-p/469391#M7107 lakshman239 2020-02-24T14:16:14Z