Microsoft Exchange
Microsoft Exchange consists of security analytics components that normalize Microsoft Exchange events, enabling you to analyze Microsoft Exchange data. Logpoint aggregates and normalizes logs related to log types, log volume, mail receivers, mail senders, mail activity, SMTP AQ failures, and SMTP bad emails from Microsoft Exchange systems so you can analyze the information through a dashboard and security report.
Enhancement
| Description | Issue ID | Reference ID |
|---|---|---|
|
Added Syslog Collector based Microsoft Exchange Server log source template to simplify the log source configuration process. Go to Creating Log Source via a Template to learn more. |
KB-22748 |
- |
Past Releases
Microsoft Exchange v5.2.2
Supported On: Logpoint v6.7.0 or later
Download: MicrosoftExchange_5.2.2.pak
SHA256: f7e6bd12ac7055365f06470f5e6461113c3d295a20859dbb2f67dd27254d7fce
Bug Fixes
The following issues are fixed:
| Description | Issue ID | Reference ID |
|---|---|---|
| Some Symantec Mail Security and MS Exchange logs were not normalized by MSExchangeCompiledNormalizer. |
KB-20529, KB-20248 |
61991 |
| Some Microsoft Exchange and Exchange MT logs were not normalized by ExchangeHTTPProxyCompiledNormalizer and LP_Exchange MT 2016. | KB-21363, KB-18174 | 75201, 68934 |
| The DefaultFolderType and LED fields were not properly normalized by ExchangeMTCompiledNormalizer. | KB-18960, KB-19426 | 70001, 71056 |
Microsoft Exchange v5.2.0
Supported On: Logpoint v6.7.0 or later
Download: MicrosoftExchange_5.2.0.pak
SHA256: 3a008b6606e882473c3d1f308ee7d0230b9a5bd055f87b7b94e669ff44161561
Enhancements
| Description | Issue ID | Reference ID | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
The message field has been parsed for the MSExchange CmdLet logs. |
KB-12092 | 51379 | ||||||||||||||||
|
Changed the taxonomy of the following fields to maintain consistency:
|
KB-11953, KB-10435 | - |
Bug Fixes
The following issues are fixed:
| Description | Issue ID | Reference ID |
|---|---|---|
| An issue in the compiled normalizer ExchangeHTTPProxyCompiledNormalizer where some of the Exchange Server logs were not normalized. | KB-13012 | 55438 |
| An issue in the compiled normalizer ExchangeMTCompiledNormalizer where the subject and message fields were parsed incorrectly in some of the Microsoft Exchange logs. | KB- 11588, KB-15477 | 49131, 55194, 60807, 61991 |
Microsoft Exchange v5.1.0
Enhancements
- It now includes the compiled normalizer ExchangeHTTPProxyCompiledNormalizer, which normalizes Exchange HTTP Proxy logs.
- The taxonomy of the following fields has been changed to maintain consistency:
| Previously Used Field Name | Modified Field Name |
|---|---|
|
calendarupdatexsocodeattempts |
calendar_update_xso_code_attempts |
| legacydn | legacy_dn |
| mbxguid | guid |
| meetingmessageprocessingattempts | meeting_message_processing_attempts |
| processingstage | processing_stage |
| processingsucceeded | processing_succeeded |
Bug Fix
- An issue where the ExchangeMTCompiledNormalizer threw a type error for an object of type NoneType.
Microsoft Exchange v5.0.1
Enhancement
A minor update to the Microsoft Exchange's normalizer which improves signature handling.
Microsoft Exchange v5.0.0
Enhancement
Microsoft Exchange has been updated to comply with Logpoint v6.7.0.
Microsoft Exchange v3.5.0
Release Date: February 26, 2020
Supported On: Logpoint v6.0.0 to v6.6.6
Download: MicrosoftExchange_3.5.0.pak
SHA256: c478cdb607b05b7dc16c109da327e8c8e6dcff61c8dc806295acb1461832c5e0
Microsoft Exchange has been upgraded to support Logpoint v6.7.0.
Enhancement
A minor update has been done in the normalizer for better signature handling.
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.