From 5c00d0b3c72207c00d7e3e70b43607599a464154 Mon Sep 17 00:00:00 2001 From: Aditi Bhoge Date: Tue, 27 Oct 2026 19:23:46 -0600 Subject: [PATCH 1/7] Add Proofpoint POD MailLog ingestion-time parser Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../ASimEmailEventProofpointPODMailLog.md | 1 + .../ASimEmailEventProofpointPODMailLog.yaml | 90 +++++++++++++++++++ ...t_ProofpointPODMailLog_CL_IngestedLogs.csv | 24 +++++ 3 files changed, 115 insertions(+) create mode 100644 Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml create mode 100644 Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md index f835d1672e4..975f133d726 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md @@ -2,6 +2,7 @@ ## Version 0.1.2 +- (2026-10-27) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog. - (2026-10-24) Normalize mailbox-form relay hosts and identify relay-less local delivery destinations - [PR #15410](https://github.com/Azure/Azure-Sentinel/pull/15410) - Extract the host from relay values such as `pps@localhost`; use the reporting device as destination only when `sm.mailer=local` and no relay endpoint is available. diff --git a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml new file mode 100644 index 00000000000..afaad419e88 --- /dev/null +++ b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml @@ -0,0 +1,90 @@ +Parser: + DisplayName: 'Ingestion-time Email Event ASIM parser for Proofpoint POD MailLog' + Version: '0.1.2' + LastUpdated: '2026-10-27' +Product: + Name: 'Proofpoint POD MailLog' +Normalization: + Schema: 'EmailEvent' + Version: '1.0.0' +Author: 'Proofpoint' +Description: | + Normalizes SMTP receipt and delivery records from ProofpointPODMailLog_CL + into ASimEmailEventLogs during ingestion. Envelope recipients remain in + AdditionalFields rather than header recipient fields. +ParserName: 'ASimEmailEventProofpointPODMailLog' +DCRType: 'Standard' +InputStream: 'Custom-ProofpointPODMailLog_CL' +SourceRawTable: 'ProofpointPODMailLog_CL' +TargetASIMTable: 'ASimEmailEventLogs' +ParserFilterQuery: | + source + | where isnotempty(tostring(sm.qid)) and (bag_has_key(sm, "from") or array_length(sm["to"]) > 0) +ParserQuery: | + source + | where isnotempty(tostring(sm.qid)) and (bag_has_key(sm, "from") or array_length(sm["to"]) > 0) + | extend Type = "ProofpointPODMailLog_CL" + | extend + IsDelivery = iif(isnotnull(array_length(sm["to"])), array_length(sm["to"]), 0) > 0, + Relay = tostring(sm.relay), + Dvc = iif(isnotempty(tostring(pps.agent)), tostring(pps.agent), tostring(metadata.origin.data.agent)), + EventStartTime = iif(isnotnull(eventTime), eventTime, TimeGenerated), + EmailMailFromAddress = replace(@"^([<>\s])+|([<>\s])+$", "", tostring(sm["from"])), + EmailSizeBytes = tolong(sm.sizeBytes), + Dsn = tostring(sm.dsn), + DeliveryStatus = tostring(sm.stat) + | parse Relay with RelayHost " [" RelayIp "]" * + | extend + EmailMailFromAddress = iff(EmailMailFromAddress contains "@", EmailMailFromAddress, ""), + RelayHost = replace(@"(\.)+$", "", tostring(split(iif(isnotempty(RelayHost), RelayHost, Relay), "@")[-1])), + RelayIp = iff(isnotnull(parse_ipv4(RelayIp)) or isnotempty(parse_ipv6(RelayIp)), RelayIp, ""), + EventResult = case(Dsn startswith "2.", "Success", Dsn startswith "4." or Dsn startswith "5.", "Failure", "NA"), + EmailProtocolName = case(tostring(sm.proto) =~ "SMTP" or tolower(tostring(sm.mailer)) in ("smtp", "esmtp"), "SMTP", ""), + EventSubType = iff(IsDelivery, "EmailSent", "EmailReceived") + | extend + SrcIpAddr = iff(IsDelivery, "", RelayIp), + DstIpAddr = iff(IsDelivery, RelayIp, ""), + Src = iff(IsDelivery, Dvc, iif(isnotempty(RelayIp), RelayIp, RelayHost)), + Dst = iff(IsDelivery, iif(isnotempty(RelayIp), RelayIp, iif(isnotempty(RelayHost), RelayHost, iff(tostring(sm.mailer) =~ "local", Dvc, ""))), Dvc), + SrcFQDN = iff(not(IsDelivery) and RelayHost contains ".", RelayHost, ""), + SrcHostname = iff(IsDelivery, tostring(split(Dvc, ".")[0]), tostring(split(RelayHost, ".")[0])), + SrcDomain = iff(IsDelivery, substring(Dvc, indexof(Dvc, ".") + 1), substring(RelayHost, indexof(RelayHost, ".") + 1)), + DvcHostname = tostring(split(Dvc, ".")[0]), + DvcDomain = iff(Dvc contains ".", substring(Dvc, indexof(Dvc, ".") + 1), ""), + DvcFQDN = iff(Dvc contains ".", Dvc, ""), + EmailMailFromDomain = iff(EmailMailFromAddress contains "@", tostring(split(EmailMailFromAddress, "@")[1]), ""), + DvcAction = iff(IsDelivery and EventResult == "Success" and DeliveryStatus startswith "Sent", "Delivered", "NA") + | extend + SrcFQDN = iff(IsDelivery, DvcFQDN, SrcFQDN), + SrcDomain = iff(iff(IsDelivery, Dvc, RelayHost) contains ".", SrcDomain, ""), + DvcDomainType = iff(isnotempty(DvcDomain), "FQDN", ""), + EventEndTime = EventStartTime, + EventCount = int(1), + EventVendor = "Proofpoint", + EventProduct = "POD MailLog", + EventSchema = "EmailEvent", + EventSchemaVersion = "1.0.0", + EventType = "EmailDelivery", + EventOriginalType = "maillog", + EmailDirection = "Unknown", + EventOriginalResultDetails = strcat(Dsn, iff(isnotempty(Dsn) and isnotempty(DeliveryStatus), "; ", ""), DeliveryStatus), + EventOriginalUid = tostring(id), + DvcEntityKey = "", + AdditionalEntities = parse_json('[]'), + AdditionalFields = pack("sm", sm, "tls", tls, "pps", pps, "metadata", metadata) + | extend + EventUid = iff(isnotempty(EventOriginalUid), strcat("ProofpointPODMailLog_CL:", EventOriginalUid), ""), + SrcDomainType = iff(isnotempty(SrcDomain), "FQDN", ""), IpAddr = SrcIpAddr + | project-rename EventMessage = data + | project + TimeGenerated, Type, EventStartTime, EventEndTime, EventCount, + EventVendor, EventProduct, EventSchema, EventSchemaVersion, + EventType, EventSubType, EventOriginalType, EventResult, + EventOriginalResultDetails, EventOriginalUid, EventUid, EventMessage, + Dvc, DvcHostname, DvcDomain, DvcDomainType, DvcFQDN, DvcAction, DvcEntityKey, + Src, SrcIpAddr, SrcHostname, SrcDomain, SrcDomainType, SrcFQDN, Dst, DstIpAddr, IpAddr, + EmailMailFromAddress, EmailMailFromDomain, EmailSizeBytes, EmailProtocolName, EmailDirection, + AdditionalFields, AdditionalEntities +Change: + Date: '2026-10-27' + Description: 'Initial ingestion-time conversion from query-time version 0.1.2.' diff --git a/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv b/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv new file mode 100644 index 00000000000..b503c4936ca --- /dev/null +++ b/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv @@ -0,0 +1,24 @@ +TimeGenerated,id,data,eventTime,metadata,pps,sm,tls,Type +2020-11-05T12:00:00Z,local-receipt-1,Synthetic mailbox-form relay receipt,2020-11-05T12:00:00Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-receipt-1"",""from"":""<>"",""relay"":""pps@localhost""}",{},ProofpointPODMailLog_CL +2020-11-05T12:00:01Z,local-receipt-2,Synthetic mailbox-form relay receipt,2020-11-05T12:00:01Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-receipt-2"",""from"":""<>"",""relay"":""support@localhost""}",{},ProofpointPODMailLog_CL +2020-11-05T12:00:02Z,local-delivery,Synthetic relay-less local delivery,2020-11-05T12:00:02Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-delivery"",""mailer"":""local"",""to"":[""""],""stat"":""Sent"",""dsn"":""2.0.0""}",{},ProofpointPODMailLog_CL +2020-11-05T12:59:43.881767+01:00,rGWIupM+g6R4PWIeqf6SMA,"2020-11-05T12:59:43.881767+01:00 t1234555 sendmail[18160]: 0A0BqJgv000000: to=, delay=00:00:00, xdelay=00:00:00, mailer=esmtp, tls_verify=OK, pri=154217, relay=relay.mail.net. [10.10.10.10], dsn=2.0.0, stat=Sent ( [InternalId=3444563792735, Hostname=eurprd01.prod.exchangelabs.com] 45616 bytes in 0.073, 610.105 KB/sec Queued mail for delivery)",2020-11-05T12:59:43.881767+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.popps.net""}","{""mailer"":""esmtp"",""xdelay"":""00:00:00"",""delay"":""00:00:00"",""tls"":{""verify"":""OK""},""dsn"":""2.0.0"",""to"":[""""],""relay"":""relay.mail.net [10.10.10.10]"",""stat"":""Sent ( [InternalId"",""pri"":""154217"",""qid"":""0A0BqJgv000000""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:44.487319+01:00,tnsgrBLZ9hdWbGRd3HMS9A,"2020-11-05T12:59:44.487319+01:00 t1234555 sendmail[18157]: 0A0BqJgv000000: to=, delay=00:00:03, xdelay=00:00:03, mailer=esmtp, tls_verify=OK, pri=2242435, relay=relay.mail.net. [10.10.10.10], dsn=2.0.0, stat=Sent ( [InternalId=18167711674865, Hostname=eurprd01.prod.exchangelabs.com] 2159936 bytes in 0.641, 3288.805 KB/sec Queued mail for delivery)",2020-11-05T12:59:44.487319+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""delay"":""00:00:03"",""dsn"":""2.0.0"",""tls"":{""verify"":""OK""},""xdelay"":""00:00:03"",""mailer"":""esmtp"",""qid"":""0A0BqJgv000000"",""pri"":""2242435"",""relay"":""relay.mail.net [10.10.10.10]"",""to"":[""""],""stat"":""Sent ( [InternalId""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:45.217049+01:00,Rv4coMMYHs/yWaGyMlR49g,"2020-11-05T12:59:45.217049+01:00 t1234555 sendmail[30248]: 0A5BqKs4030248: from=, size=8255, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:45.217049+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""agent"":""t1234555.ppops.net"",""cid"":""CID""}","{""from"":"""",""auth"":""NONE"",""class"":""0"",""proto"":""SMTP"",""daemon"":""MTA"",""qid"":""0A5BqKs4030248"",""sizeBytes"":""8255"",""nrcpts"":""1"",""relay"":""t1234555.ppops.net [127.0.0.1]""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:46.045430+01:00,wYvxXQ8YHRvWgpopQeLskA,"2020-11-05T12:59:46.045430+01:00 t1234555 sendmail[18165]: 0A5BqKs4030248: to=, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, tls_verify=OK, pri=128255, relay=externals-adidasgr...ction.outlook.com. [10.10.10.10], dsn=2.0.0, stat=Sent ( [InternalId=...B6347.eurprd01.prod.exchangelabs.com] 19101 bytes in 0.071, 260.062 KB/sec Queued mail for delivery)",2020-11-05T12:59:46.045430+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""pri"":""128255"",""qid"":""0A5BqKs4030248"",""stat"":""Sent ( [InternalId"",""relay"":""relay.mail.net [10.10.10.10]"",""to"":[""""],""tls"":{""verify"":""OK""},""dsn"":""2.0.0"",""delay"":""00:00:01"",""xdelay"":""00:00:01"",""mailer"":""esmtp""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:49.375433+01:00,S57nYRhfj7qb0FUTymKhfg,"2020-11-05T12:59:49.375433+01:00 t1234555 sendmail[30448]: 0A5BqZtL030448: from=, size=148995, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:49.375433+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""agent"":""t1234555.ppops.net"",""cid"":""CID""}","{""relay"":""relay.mail.net [10.10.10.10]"",""nrcpts"":""1"",""daemon"":""MTA"",""sizeBytes"":""148995"",""qid"":""0A5BqZtL030448"",""proto"":""SMTP"",""auth"":""NONE"",""class"":""0"",""msgid"":"""",""tls"":{""verify"":""NONE""},""from"":""""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:50.261397+01:00,KmK6ghZhp+8N+k+y5M/ZrA,"2020-11-05T12:59:50.261397+01:00 t1234555 sendmail[30240]: 0A5BqJBl030240: from=, size=560625, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:50.261397+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""agent"":""t1234555.ppops.net"",""cid"":""CID""}","{""relay"":""relay.mail.net [10.10.10.10]"",""nrcpts"":""1"",""daemon"":""MTA"",""sizeBytes"":""560625"",""qid"":""0A5BqJBl030240"",""proto"":""SMTP"",""auth"":""NONE"",""class"":""0"",""tls"":{""verify"":""NONE""},""msgid"":"""",""from"":""""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:50.356977+01:00,6o9hWtB++VRhC2HZCU0/mQ,"2020-11-05T12:59:50.356977+01:00 t1234555 sendmail[30427]: 0A5BqWEW030427: from=, size=24805, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:50.356977+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""nrcpts"":""1"",""relay"":""relay.mail.net [10.10.10.10]"",""daemon"":""MTA"",""qid"":""0A5BqWEW030427"",""sizeBytes"":""24805"",""class"":""0"",""auth"":""NONE"",""proto"":""SMTP"",""from"":"""",""msgid"":"""",""tls"":{""verify"":""NONE""}}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:51.698428+01:00,jOtbUua8OnKtoWNglHt4GA,"2020-11-05T12:59:51.698428+01:00 t1234555 sendmail[18173]: 0A5BqZtL030448: to=, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, tls_verify=OK, pri=268995, relay=reebok-com.mail.protection.outlook.com. [104.47.1.36], dsn=2.0.0, stat=Sent ( [InternalId=8723078591673, Hostname=AM0PR...281.eurprd01.prod.exchangelabs.com] 165052 bytes in 0.159, 1010.909 KB/sec Queued mail for delivery)",2020-11-05T12:59:51.698428+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""mailer"":""esmtp"",""xdelay"":""00:00:02"",""delay"":""00:00:02"",""tls"":{""verify"":""OK""},""dsn"":""2.0.0"",""to"":[""""],""relay"":""relay.mail.net [10.10.10.10]"",""stat"":""Sent ( [InternalId"",""qid"":""0A5BqZtL030448"",""pri"":""268995""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:51.739825+01:00,c5Fw7jOLm46PeqG8UJEWbg,"2020-11-05T12:59:51.739825+01:00 t1234555 sendmail[18175]: 0A5BqJBl030240: to=, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, tls_verify=OK, pri=680625, relay=relay.mail.net. [10.10.10.10], dsn=2.0.0, stat=Sent ( [InternalId=2...285.eurprd01.prod.exchangelabs.com] 583928 bytes in 0.236, 2413.571 KB/sec Queued mail for delivery)",2020-11-05T12:59:51.739825+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""stat"":""Sent ( [InternalId"",""relay"":""relay.mail.net [10.10.10.10]"",""to"":[""""],""qid"":""0A5BqJBl030240"",""pri"":""680625"",""xdelay"":""00:00:01"",""mailer"":""esmtp"",""tls"":{""verify"":""OK""},""dsn"":""2.0.0"",""delay"":""00:00:01""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:51.822918+01:00,/ALzUxRLM2Tz0YJbdoltTQ,"2020-11-05T12:59:51.822918+01:00 t1234555 sendmail[18177]: 0A5BqWEW030427: to=, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, tls_verify=OK, pri=144805, relay=relay.mail.net. [10.10.10.10], dsn=2.0.0, stat=Sent ( [InternalI...B2686.eurprd01.prod.exchangelabs.com] 36596 bytes in 0.149, 239.832 KB/sec Queued mail for delivery)",2020-11-05T12:59:51.822918+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""qid"":""0A5BqWEW030427"",""pri"":""144805"",""stat"":""Sent ( [InternalI...B2686.eurprd01.prod.exchangelabs.com] 36596 bytes in 0.149"",""relay"":""relay.mail.net [10.10.10.10]"",""to"":[""""],""tls"":{""verify"":""OK""},""dsn"":""2.0.0"",""delay"":""00:00:01"",""xdelay"":""00:00:01"",""mailer"":""esmtp""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:52.368451+01:00,z++bC1rsPj/CWSn4ZScnTg,"2020-11-05T12:59:52.368451+01:00 t1234555 sendmail[30243]: 0A5BqJgw030243: from=, size=301268, class=0, nrcpts=2, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:52.368451+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""agent"":""t1234555.ppops.net"",""cid"":""CID""}","{""daemon"":""MTA"",""qid"":""0A5BqJgw030243"",""sizeBytes"":""301268"",""nrcpts"":""2"",""relay"":""relay.mail.net [10.10.10.10]"",""from"":"""",""msgid"":"""",""tls"":{""verify"":""NONE""},""auth"":""NONE"",""class"":""0"",""proto"":""SMTP""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:53.128685+01:00,EdOJdJWaYM6H2KYMjj0A8w,"2020-11-05T12:59:53.128685+01:00 t1234555 sendmail[30240]: 0A5BqJBm030240: from=, size=301692, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:53.128685+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""agent"":""t1234555.ppops.net"",""cid"":""CID""}","{""class"":""0"",""auth"":""NONE"",""proto"":""SMTP"",""from"":"""",""msgid"":"""",""tls"":{""verify"":""NONE""},""nrcpts"":""1"",""relay"":""relay.mail.net [10.10.10.10]"",""qid"":""0A5BqJBm030240"",""sizeBytes"":""301692"",""daemon"":""MTA""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:54.447139+01:00,o1LSqlKOOCILO8WDfvM+SQ,"2020-11-05T12:59:54.447139+01:00 t1234555 sendmail[30233]: 0A5BqHS0030233: from=, size=65592, class=-60, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:54.447139+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""agent"":""t1234555.ppops.net"",""cid"":""CID""}","{""auth"":""NONE"",""class"":""-60"",""proto"":""SMTP"",""from"":"""",""msgid"":"""",""tls"":{""verify"":""NONE""},""nrcpts"":""1"",""relay"":""relay.mail.net [10.10.10.10]"",""qid"":""0A5BqHS0030233"",""sizeBytes"":""65592"",""daemon"":""MTA""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:54.882947+01:00,nSWY7WY+wg3vqLBEV9rlFA,"2020-11-05T12:59:54.882947+01:00 t1234555 sendmail[30448]: 0A5BqZtM030448: from=, size=1060602, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:54.882947+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""from"":"""",""tls"":{""verify"":""NONE""},""msgid"":"""",""class"":""0"",""auth"":""NONE"",""proto"":""SMTP"",""qid"":""0A5BqZtM030448"",""sizeBytes"":""1060602"",""daemon"":""MTA"",""nrcpts"":""1"",""relay"":""t1234555.ppops.net [127.0.0.1]""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:55.581745+01:00,nQsGhy3nue3O9PXE9cyZ4A,"2020-11-05T12:59:55.581745+01:00 t1234555 sendmail[30464]: 0A5Bqbi3030464: from=, size=67596, class=-60, nrcpts=4, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=t1234555.ppops.net [127.0.0.1]",2020-11-05T12:59:55.581745+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""class"":""-60"",""auth"":""NONE"",""proto"":""SMTP"",""from"":"""",""tls"":{""verify"":""NONE""},""msgid"":"""",""nrcpts"":""4"",""relay"":""relay.mail.net [10.10.10.10]"",""daemon"":""MTA"",""qid"":""0A5Bqbi3030464"",""sizeBytes"":""67596""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:55.702601+01:00,TLgvfc+EnwlgpGstT4gKKg,"2020-11-05T12:59:55.702601+01:00 t1234555 sendmail[18188]: 0A5BqJBm030240: to=, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, tls_verify=OK, pri=421692, relay=relay.mail.net. [104.47.0.36], dsn=2.0.0, stat=Sent ( [InternalId=4...537.eurprd01.prod.exchangelabs.com] 319576 bytes in 0.197, 1576.411 KB/sec Queued mail for delivery)",2020-11-05T12:59:55.702601+01:00,"{""origin"":{""data"":{""agent"":""t1234555.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""t1234555.ppops.net""}","{""delay"":""00:00:02"",""dsn"":""2.0.0"",""tls"":{""verify"":""OK""},""mailer"":""esmtp"",""xdelay"":""00:00:02"",""pri"":""421692"",""qid"":""0A5BqJBm030240"",""to"":[""""],""relay"":""relay.mail.net [10.10.10.10]"",""stat"":""Sent ( [InternalId""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:25.616354+01:00,4k8PCXVfzzmB3MOLxMJzow,"2020-11-05T12:59:25.616354+01:00 m0000001 sendmail[25015]: 0A5Bs6pD012719: to=, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, tls_verify=OK, pri=172457, relay=relay.mail.net. [104.47.0.36], dsn=2.0.0, stat=Sent ( [InternalId=57157424788340, Ho...MB5237.eurprd01.prod.exchangelabs.com] 63604 bytes in 1.095, 56.722 KB/sec Queued mail for delivery)",2020-11-05T12:59:25.616354+01:00,"{""origin"":{""data"":{""agent"":""m0000001.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""m0000001.ppops.net""}","{""relay"":""relay.mail.net [10.10.10.10]"",""to"":[""""],""dsn"":""2.0.0"",""qid"":""0A5Bs6pD012719"",""tls"":{""verify"":""OK""},""mailer"":""esmtp"",""stat"":""Sent ( [InternalId"",""xdelay"":""00:00:02"",""delay"":""00:00:02"",""pri"":""172457""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:25.782683+01:00,yHgmo29ReWNG+wG9z2081w,"2020-11-05T12:59:25.782683+01:00 m0000001 sendmail[12716]: 0A5Bs66u012716: from=, size=133518, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=m0000001.ppops.net [127.0.0.1]",2020-11-05T12:59:25.782683+01:00,"{""origin"":{""data"":{""agent"":""m0000001.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""m0000001.ppops.net""}","{""daemon"":""MTA"",""sizeBytes"":""133518"",""from"":"""",""nrcpts"":""1"",""tls"":{""verify"":""NONE""},""class"":""0"",""qid"":""0A5Bs66u012716"",""relay"":""relay.mail.net [10.10.10.10]"",""proto"":""SMTP"",""auth"":""NONE"",""msgid"":""""}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:27.214776+01:00,/7mPV7fork8xQ2FLmmV5gA,"2020-11-05T12:59:27.214776+01:00 m0000001 sendmail[25035]: 0A5Bs66u012716: to=, delay=00:00:02, xdelay=00:00:02, mailer=esmtp, tls_verify=OK, pri=253518, relay=relay.mail.net. [104.47.0.36], dsn=2.0.0, stat=Sent ( [InternalId=50349901633126, Hos...245.eurprd01.prod.exchangelabs.com] 147801 bytes in 0.083, 1737.387 KB/sec Queued mail for delivery)",2020-11-05T12:59:27.214776+01:00,"{""origin"":{""data"":{""agent"":""m0000001.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""m0000001.ppops.net""}","{""xdelay"":""00:00:02"",""stat"":""Sent ( [InternalId"",""delay"":""00:00:02"",""pri"":""253518"",""dsn"":""2.0.0"",""to"":[""""],""relay"":""relay.mail.net [10.10.10.10]"",""mailer"":""esmtp"",""qid"":""0A5Bs66u012716"",""tls"":{""verify"":""OK""}}",null,ProofpointPODMailLog_CL +2020-11-05T12:59:27.672144+01:00,kcFh9j7CGJ5CnjZ1l/0fYw,"2020-11-05T12:59:27.672144+01:00 m0000001 sendmail[12713]: 0A5Bs5V2012713: from=, size=20387, class=0, nrcpts=1, msgid=, proto=SMTP, daemon=MTA, tls_verify=NONE, auth=NONE, relay=m0000001.ppops.net [127.0.0.1]",2020-11-05T12:59:27.672144+01:00,"{""origin"":{""data"":{""agent"":""m0000001.ppops.net"",""cid"":""CID""}}}","{""cid"":""CID"",""agent"":""m0000001.ppops.net""}","{""nrcpts"":""1"",""from"":"""",""sizeBytes"":""20387"",""daemon"":""MTA"",""class"":""0"",""tls"":{""verify"":""NONE""},""qid"":""0A5Bs5V2012713"",""auth"":""NONE"",""msgid"":"""",""proto"":""SMTP"",""relay"":""m0000001.ppops.net [127.0.0.1]""}",null,ProofpointPODMailLog_CL From 3fbbeac35f4d47c9cd29d21976fe9911d76f1572 Mon Sep 17 00:00:00 2001 From: Aditi Bhoge Date: Tue, 27 Oct 2026 19:25:54 -0600 Subject: [PATCH 2/7] Link MailLog ingestion-time changelog to PR #15463 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../CHANGELOG/ASimEmailEventProofpointPODMailLog.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md index 975f133d726..67cdf9a26fb 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md @@ -2,7 +2,7 @@ ## Version 0.1.2 -- (2026-10-27) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog. +- (2026-10-27) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog - [PR #15463](https://github.com/Azure/Azure-Sentinel/pull/15463) - (2026-10-24) Normalize mailbox-form relay hosts and identify relay-less local delivery destinations - [PR #15410](https://github.com/Azure/Azure-Sentinel/pull/15410) - Extract the host from relay values such as `pps@localhost`; use the reporting device as destination only when `sm.mailer=local` and no relay endpoint is available. From 63a3b545388bc01002df3888d877c6042bff77f0 Mon Sep 17 00:00:00 2001 From: Aditi Bhoge Date: Tue, 27 Oct 2026 19:27:58 -0600 Subject: [PATCH 3/7] Align MailLog ingestion-time dates with PR creation date Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../CHANGELOG/ASimEmailEventProofpointPODMailLog.md | 2 +- .../IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md index 67cdf9a26fb..64c99e6d76a 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md @@ -2,7 +2,7 @@ ## Version 0.1.2 -- (2026-10-27) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog - [PR #15463](https://github.com/Azure/Azure-Sentinel/pull/15463) +- (2026-10-28) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog - [PR #15463](https://github.com/Azure/Azure-Sentinel/pull/15463) - (2026-10-24) Normalize mailbox-form relay hosts and identify relay-less local delivery destinations - [PR #15410](https://github.com/Azure/Azure-Sentinel/pull/15410) - Extract the host from relay values such as `pps@localhost`; use the reporting device as destination only when `sm.mailer=local` and no relay endpoint is available. diff --git a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml index afaad419e88..8fd12f0ab53 100644 --- a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml +++ b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml @@ -1,7 +1,7 @@ Parser: DisplayName: 'Ingestion-time Email Event ASIM parser for Proofpoint POD MailLog' Version: '0.1.2' - LastUpdated: '2026-10-27' + LastUpdated: '2026-10-28' Product: Name: 'Proofpoint POD MailLog' Normalization: @@ -86,5 +86,5 @@ ParserQuery: | EmailMailFromAddress, EmailMailFromDomain, EmailSizeBytes, EmailProtocolName, EmailDirection, AdditionalFields, AdditionalEntities Change: - Date: '2026-10-27' + Date: '2026-10-28' Description: 'Initial ingestion-time conversion from query-time version 0.1.2.' From da6dcedf56c44cab50074214d71bb9eeaa4ee02c Mon Sep 17 00:00:00 2001 From: Aditi Bhoge Date: Wed, 28 Oct 2026 16:39:40 -0600 Subject: [PATCH 4/7] Add MailLog fixture row rejected by ingestion filter Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- ...D MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv | 1 + 1 file changed, 1 insertion(+) diff --git a/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv b/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv index b503c4936ca..135543fad3f 100644 --- a/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv +++ b/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv @@ -1,4 +1,5 @@ TimeGenerated,id,data,eventTime,metadata,pps,sm,tls,Type +2020-11-05T12:00:03Z,filter-rejected-empty-recipients,Synthetic non-receipt non-delivery record,2020-11-05T12:00:03Z,{},"{""agent"":""mail.example.test""}","{""qid"":""filter-rejected-empty-recipients"",""to"":[]}",{},ProofpointPODMailLog_CL 2020-11-05T12:00:00Z,local-receipt-1,Synthetic mailbox-form relay receipt,2020-11-05T12:00:00Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-receipt-1"",""from"":""<>"",""relay"":""pps@localhost""}",{},ProofpointPODMailLog_CL 2020-11-05T12:00:01Z,local-receipt-2,Synthetic mailbox-form relay receipt,2020-11-05T12:00:01Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-receipt-2"",""from"":""<>"",""relay"":""support@localhost""}",{},ProofpointPODMailLog_CL 2020-11-05T12:00:02Z,local-delivery,Synthetic relay-less local delivery,2020-11-05T12:00:02Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-delivery"",""mailer"":""local"",""to"":[""""],""stat"":""Sent"",""dsn"":""2.0.0""}",{},ProofpointPODMailLog_CL From eac341c6d4f369d93d142b0902a9504e09003610 Mon Sep 17 00:00:00 2001 From: Aditi Bhoge Date: Wed, 28 Oct 2026 16:52:55 -0600 Subject: [PATCH 5/7] Use DCR-compatible MailLog sender filter Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../CHANGELOG/ASimEmailEventProofpointPODMailLog.md | 1 + .../IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml | 4 ++-- ...ailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv | 1 + 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md index 64c99e6d76a..8960c2bd0ba 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md @@ -3,6 +3,7 @@ ## Version 0.1.2 - (2026-10-28) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog - [PR #15463](https://github.com/Azure/Azure-Sentinel/pull/15463) +- Use a non-null envelope-sender check supported by DCR transforms, including empty sender values; fixtures cover selected empty senders and rejected records without a sender or recipients. - (2026-10-24) Normalize mailbox-form relay hosts and identify relay-less local delivery destinations - [PR #15410](https://github.com/Azure/Azure-Sentinel/pull/15410) - Extract the host from relay values such as `pps@localhost`; use the reporting device as destination only when `sm.mailer=local` and no relay endpoint is available. diff --git a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml index 8fd12f0ab53..1dd1c82cbe7 100644 --- a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml +++ b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml @@ -19,10 +19,10 @@ SourceRawTable: 'ProofpointPODMailLog_CL' TargetASIMTable: 'ASimEmailEventLogs' ParserFilterQuery: | source - | where isnotempty(tostring(sm.qid)) and (bag_has_key(sm, "from") or array_length(sm["to"]) > 0) + | where isnotempty(tostring(sm.qid)) and (isnotnull(sm["from"]) or array_length(sm["to"]) > 0) ParserQuery: | source - | where isnotempty(tostring(sm.qid)) and (bag_has_key(sm, "from") or array_length(sm["to"]) > 0) + | where isnotempty(tostring(sm.qid)) and (isnotnull(sm["from"]) or array_length(sm["to"]) > 0) | extend Type = "ProofpointPODMailLog_CL" | extend IsDelivery = iif(isnotnull(array_length(sm["to"])), array_length(sm["to"]), 0) > 0, diff --git a/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv b/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv index 135543fad3f..739a25f9967 100644 --- a/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv +++ b/Sample Data/ASIM/Proofpoint_POD MailLog_EmailEvent_ProofpointPODMailLog_CL_IngestedLogs.csv @@ -1,4 +1,5 @@ TimeGenerated,id,data,eventTime,metadata,pps,sm,tls,Type +2020-11-05T12:00:04Z,filter-selected-empty-sender,Synthetic receipt with empty envelope sender,2020-11-05T12:00:04Z,{},"{""agent"":""mail.example.test""}","{""qid"":""filter-selected-empty-sender"",""from"":"""",""to"":[]}",{},ProofpointPODMailLog_CL 2020-11-05T12:00:03Z,filter-rejected-empty-recipients,Synthetic non-receipt non-delivery record,2020-11-05T12:00:03Z,{},"{""agent"":""mail.example.test""}","{""qid"":""filter-rejected-empty-recipients"",""to"":[]}",{},ProofpointPODMailLog_CL 2020-11-05T12:00:00Z,local-receipt-1,Synthetic mailbox-form relay receipt,2020-11-05T12:00:00Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-receipt-1"",""from"":""<>"",""relay"":""pps@localhost""}",{},ProofpointPODMailLog_CL 2020-11-05T12:00:01Z,local-receipt-2,Synthetic mailbox-form relay receipt,2020-11-05T12:00:01Z,{},"{""agent"":""mail.example.test""}","{""qid"":""local-receipt-2"",""from"":""<>"",""relay"":""support@localhost""}",{},ProofpointPODMailLog_CL From dc5874f60b63fe94bb436a060c892dc01aadaece Mon Sep 17 00:00:00 2001 From: Aditi Bhoge Date: Wed, 28 Oct 2026 17:04:29 -0600 Subject: [PATCH 6/7] Match MailLog recipient count fallback type for DCR Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../CHANGELOG/ASimEmailEventProofpointPODMailLog.md | 1 + .../IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md index 8960c2bd0ba..fbe6aea65ba 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md @@ -4,6 +4,7 @@ - (2026-10-28) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog - [PR #15463](https://github.com/Azure/Azure-Sentinel/pull/15463) - Use a non-null envelope-sender check supported by DCR transforms, including empty sender values; fixtures cover selected empty senders and rejected records without a sender or recipients. +- Match the recipient-count fallback to the long return type of array_length for DCR compilation. - (2026-10-24) Normalize mailbox-form relay hosts and identify relay-less local delivery destinations - [PR #15410](https://github.com/Azure/Azure-Sentinel/pull/15410) - Extract the host from relay values such as `pps@localhost`; use the reporting device as destination only when `sm.mailer=local` and no relay endpoint is available. diff --git a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml index 1dd1c82cbe7..10d84a350d3 100644 --- a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml +++ b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml @@ -25,7 +25,7 @@ ParserQuery: | | where isnotempty(tostring(sm.qid)) and (isnotnull(sm["from"]) or array_length(sm["to"]) > 0) | extend Type = "ProofpointPODMailLog_CL" | extend - IsDelivery = iif(isnotnull(array_length(sm["to"])), array_length(sm["to"]), 0) > 0, + IsDelivery = iif(isnotnull(array_length(sm["to"])), array_length(sm["to"]), long(0)) > 0, Relay = tostring(sm.relay), Dvc = iif(isnotempty(tostring(pps.agent)), tostring(pps.agent), tostring(metadata.origin.data.agent)), EventStartTime = iif(isnotnull(eventTime), eventTime, TimeGenerated), From 48020065821a26d316ba44044a4e9fae15455647 Mon Sep 17 00:00:00 2001 From: Aditi Bhoge Date: Wed, 28 Oct 2026 17:16:09 -0600 Subject: [PATCH 7/7] Use boolean MailLog delivery classification for DCR Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .../CHANGELOG/ASimEmailEventProofpointPODMailLog.md | 2 +- .../IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md index fbe6aea65ba..97d4e3cc715 100644 --- a/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md +++ b/Parsers/ASimEmailEvent/CHANGELOG/ASimEmailEventProofpointPODMailLog.md @@ -4,7 +4,7 @@ - (2026-10-28) Add the ingestion-time EmailEvent parser and source-table-specific fixture for Proofpoint POD MailLog - [PR #15463](https://github.com/Azure/Azure-Sentinel/pull/15463) - Use a non-null envelope-sender check supported by DCR transforms, including empty sender values; fixtures cover selected empty senders and rejected records without a sender or recipients. -- Match the recipient-count fallback to the long return type of array_length for DCR compilation. +- Classify delivery using a boolean recipient-count condition to avoid mixed numeric branch types during DCR compilation. - (2026-10-24) Normalize mailbox-form relay hosts and identify relay-less local delivery destinations - [PR #15410](https://github.com/Azure/Azure-Sentinel/pull/15410) - Extract the host from relay values such as `pps@localhost`; use the reporting device as destination only when `sm.mailer=local` and no relay endpoint is available. diff --git a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml index 10d84a350d3..c163202695f 100644 --- a/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml +++ b/Parsers/ASimEmailEvent/IngestTimeParsers/ASimEmailEventProofpointPODMailLog.yaml @@ -25,7 +25,7 @@ ParserQuery: | | where isnotempty(tostring(sm.qid)) and (isnotnull(sm["from"]) or array_length(sm["to"]) > 0) | extend Type = "ProofpointPODMailLog_CL" | extend - IsDelivery = iif(isnotnull(array_length(sm["to"])), array_length(sm["to"]), long(0)) > 0, + IsDelivery = iff(array_length(sm["to"]) > 0, true, false), Relay = tostring(sm.relay), Dvc = iif(isnotempty(tostring(pps.agent)), tostring(pps.agent), tostring(metadata.origin.data.agent)), EventStartTime = iif(isnotnull(eventTime), eventTime, TimeGenerated),