Can the Splunk Add-on for Cisco ESA report on other Ironport activities besides clean or spam?

[nychawk]

Does the Cisco Ironport app report other than spam and clean activities, i,.e. virus, quarantine, etc?
I've got this installed and working, except I am only seeing clean and spam; beautiful reporting though.

If other reporting is possible, is it because I need to configure my Ironport to deliver this data?

Thank you

[ananthkumar12]

IronPort logs only Spam and Virus info in the logs. So, the app only reports on those activities

[nychawk]

App does not report virus at all

[jcoates_splunk]

you should find all the logged actions in a field called vendor_action.

[nychawk]

Thank you, data was found in virus_vendor_category.

Any plans for this app to create reporting based on this information?