Hi
When i'm reviewing an EVent, is there a field that tells me if it came from a forwarder?
Most of the time the host
field but occasionally this is borked and you have to get what you need from the source
field.
Not specifically. Compare the host
field to your list of forwarders.