new fortimail log

[doc dodo]

Hello,

I noticed changes in fortimail log. 

Perhaps this information will be useful for developers and decoder changes in future updates.

Old log:

date=2026-05-06 time=15:55:00.697 device_id=FEVM04TM22050197 log_id=0200002157 type=statistics pri=information  session_id=\"646Ct0ge002156-646Ct0gg002156\" client_name=\"smtp.asdas.com\" client_ip=\"11.11.1.111\" client_cc=\"RU\" dst_ip=\"22.22.2.8\" from=\"em...@host.com\" hfrom=\"info@ host.com\" to=\"info@ host2.com\" polid=\"0:1:1:SYSTEM\" domain=\"111.host.com\" mailer=\"mta\" resolved=\"OK\" src_type=\"ext\" direction=\"in\" virus=\"\" disposition=\"Accept\" classifier=\"Not Spam\" message_length=\"21729\" subject=\"asdsadasdsda\" message_id=\"E1wKbmF-...@ucs701-ucs-1.msg.com\" recv_time=\"\" notif_delay=\"0\" scan_time=\"0.011280\" xfer_time=\"0.100632\" srcfolder=\"\" read_status=\"\""

New log:

date=2026-07-14 time=16:20:52.447 device_id=FEVM04TM22050197 eventtime=1784035252447 tz="+0300" log_id=0200005515 type=statistics pri=information  session_id="66ECx0r9016954-66ECx0rC016954" client_name="mail.yilanpark.com" client_ip="11.11.1.142" client_cc="US" dst_ip="222.22.22.8" from="purc...@hsote.com" hfrom="purc...@asdasd.com" to="r...@ssdf.com" polid="0:1:1:SYSTEM" domain="11.host.com" mailer="mta" resolved="OK" src_type="ext" direction="in" virus="Malware-Outbreak, Malware-Outbreak" disposition="System Quarantine;Defer Disposition" classifier="Malware Outbreak" detail='Virus' message_length="435013" subject="Quotation Enquiry –  Indent No. MT26 0714" message_id="20260714030810....@yilan.com" recv_time="" notif_delay="0" scan_time="0.229249" xfer_time="0.000769" srcfolder="" read_status=""

[Md. Nazmur Sakib]

I would like to share this information here in case anyone needs it. You can use the existing default decoders for Fortimal by modifying the parent decoder.

To achieve this, copy the existing decoder to a custom decoder file.
cp /var/ossec/ruleset/decoders/0102-fortimail_decoders.xml /var/ossec/etc/decoders/custom-fortimail.xml

Change file permissions.

chmod 660 /var/ossec/etc/decoders/custom-fortimail.xml

chown wazuh:wazuh /var/ossec/etc/decoders/custom-fortimail.xml

Open the file with the text editor

/var/ossec/etc/decoders/custom-fortimail.xml

Now modify the decoders so that they can handle your new logs. Replace the parent decoder(the first decoder in the file) with this one:
<decoder name="fortimail-like">

  <prematch>time=\S+ device_id=\.+ log_id=\S+ |time=\S+ devid=\S+ log_id=\S+</prematch>

</decoder>

Now restart the Wazuh manager.

systemctl restart wazuh-manager

Test results:

Let us know if anyone face any issues with decoding the logs.