---
title: "mail.fortinet"
canonical: "https://docs.devo.com/space/latest/356679723/mail.fortinet"
format: markdown
---
> Macro (toc)

## Purpose

Use FortiMail data to detect malicious emails.

For comma separated and space separated firewall logs, use [firewall.fortinet](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94663604).  For Fortinet logs in CEF format, use [cef0.fortinet](https://devodocs.atlassian.net/wiki/spaces/latest/pages/413630529).  For Fortinet [identity management](https://www.fortinet.com/solutions/enterprise-midsize-business/identity-access-management), use [iam.fortinet](https://devodocs.atlassian.net/wiki/spaces/latest/pages/370475009).

## Send it

Data should be sent using the [Devo Relay](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96468993).

### Log formats

[Fortinet logs](https://docs.fortinet.com/document/fortigate/7.6.3/fortios-log-message-reference/670197/log-types-and-subtypes) may be in *comma separated value* format or *space separated value* format.  Both formats are widely used.  Generally, Devo uses *comma separated value* by default.  To parse your logs with the *space separated value* option, add `.noncsv` to the *target tag* using the relay rule.

### Example [relay rules](https://devodocs.atlassian.net/wiki/spaces/latest/pages/96469377)

```
         Source message: 
            Source data: ,type=([^,]+),(?:subtype=([^,]+)(?:,|$))?
             Source tag: 
             Target tag: mail.fortinet.\\D1.\\D2
Sent without syslog tag: false
        Stop processing: false
```


```
         Source message: 
            Source data:  type=\"{0,1}([^\s^\"]+)\"{0,1}\ssubtype=\"{0,1}([^\s^\"]+)\"{0,1}
             Source tag: 
             Target tag: mail.fortinet.\\D1.\\D2.noncsv
Sent without syslog tag: true
        Stop processing: true
```

## Secure it

An analyst at example.com wants to identify accounts that are sending malware so the accounts can be isolated.

```
from mail.fortinet.virus.infected 
where has(message,"is infected"),
has(mailFrom,"example.com")
group by mailFrom
```

## Tags and tables

| **[Tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204)** | **[Tables](https://devodocs.atlassian.net/wiki/spaces/latest/pages/94764298)** |
| --- | --- |
| mail.fortinet.event.admin | mail.fortinet.event.admin |
| mail.fortinet.event.admin.noncsv |  |
| mail.fortinet.event.config | mail.fortinet.event.config |
| mail.fortinet.event.config.noncsv |  |
| mail.fortinet.event.ha | mail.fortinet.event.ha |
| mail.fortinet.event.ha.noncsv |  |
| mail.fortinet.event.smtp | mail.fortinet.event.smtp |
| mail.fortinet.event.smtp.noncsv |  |
| mail.fortinet.event.update | mail.fortinet.event.update |
| mail.fortinet.event.update.noncsv |  |
| mail.fortinet.spam.noncsv | mail.fortinet.spam |
| mail.fortinet.statistics.noncsv | mail.fortinet.statistics |
| mail.fortinet.virus.infected.noncsv | mail.fortinet.virus.infected |