Hi
When i'm reviewing an EVent, is there a field that tells me if it came from a forwarder?
Most of the time the host field but occasionally this is borked and you have to get what you need from the source field.
host
source
Not specifically. Compare the host field to your list of forwarders.
