Issue with CIM Mapping for ES

[mustafag]

I am receiving the EMail logs from Proofpoint Email gateway via syslog. The single email communication include the multiple logs and we can use the one transaction id to create the full events which include the full email communication details.

As this meaningful event can be generated through correlation of transcation id, how can i map this event with CIM and add the necessary tag?

[lakshman239]

Generally the TA should means to extract required eventtype (s) to map to Email data model. If it isn't and you are writting custom TA or updating existing TA, I would suggest not combine all events to get full email transaction, but have one or more events only for inbound email and one or more outbound. This way you can create eventtypes for inbound and outbound and then map them to Email datamodel.