Overview

SIEM HTTP event forwarder

From version 5.5 LibraCyber ESG provides an HTTP event forwarder, a feature that allows you to send the message details to a SIEM HTTP endpoint, in JSON format.

Message format

The message is serialized into JSON, and the format is the same of the API /messages-journal.

{
  "id": "string",
  "messageId": "string",
  "receivedOn": "CURRENT_TIMESTAMP",
  "sentOn": "2025-12-10T10:39:12.201Z",
  "hostname": "string",
  "senderIp": "string",
  "trusted": true,
  "sender": "string",
  "headerFrom": "string",
  "recipients": {
    "additionalProp1": {},
    "additionalProp2": {},
    "additionalProp3": {}
  },
  "subject": "string",
  "size": 0,
  "result": {
    "id": 0,
    "name": "string"
  },
  "scan": {
    "analyzedOn": "CURRENT_TIMESTAMP",
    "mailEncryption": true,
    "released": true,
    "recalled": true,
    "rescanned": true,
    "quarantined": true,
    "delivered": true,
    "falsePositive": true,
    "falseNegative": true,
    "virusInfected": true,
    "nameInfected": true,
    "otherInfected": true,
    "urlsand": 0,
    "quicksand": 0,
    "securityReport": "string",
    "spam": true,
    "highSpam": true,
    "spamWelcomelisted": true,
    "spamBlocklisted": true,
    "spamScore": "0.00",
    "spamReport": "string",
    "whaling": true,
    "dlp": true,
    "dlpDictionary": true,
    "highDlp": true,
    "dlpWelcomelisted": true,
    "dlpBlocklisted": true,
    "dlpScore": "0.00",
    "dlpReport": "string",
    "scanTime": 0,
    "machineLearned": "string",
    "quickSandInDryRun": true
  },
  "reject": {
    "helo": "string",
    "deliveryStatusNotification": {
      "success": true,
      "persistentTransientFailure": true,
      "permanentError": true,
      "subject": 0,
      "detail": 0,
      "statusCode": "string",
      "statusDescription": "string"
    }
  },
  "quarantined": true,
  "userReleasable": true,
  "onBehalfOf": "string",
  "attachments": {
    "additionalProp1": {
      "sha256": "string",
      "fileName": "string",
      "fileType": "string",
      "fileSize": 0,
      "virusInfected": true,
      "nameInfected": true,
      "otherInfected": true,
      "fileBlock": 0,
      "fromCache": true,
      "quickType": 0,
      "quickAction": 0,
      "disarmPdf": true
    },
    "additionalProp2": {
      "sha256": "string",
      "fileName": "string",
      "fileType": "string",
      "fileSize": 0,
      "virusInfected": true,
      "nameInfected": true,
      "otherInfected": true,
      "fileBlock": 0,
      "fromCache": true,
      "quickType": 0,
      "quickAction": 0,
      "disarmPdf": true
    },
    "additionalProp3": {
      "sha256": "string",
      "fileName": "string",
      "fileType": "string",
      "fileSize": 0,
      "virusInfected": true,
      "nameInfected": true,
      "otherInfected": true,
      "fileBlock": 0,
      "fromCache": true,
      "quickType": 0,
      "quickAction": 0,
      "disarmPdf": true
    }
  },
  "uris": {
    "additionalProp1": {
      "uri": "string",
      "isUrlsandRewrite": "string",
      "isUrlsandIgnored": "string"
    },
    "additionalProp2": {
      "uri": "string",
      "isUrlsandRewrite": "string",
      "isUrlsandIgnored": "string"
    },
    "additionalProp3": {
      "uri": "string",
      "isUrlsandRewrite": "string",
      "isUrlsandIgnored": "string"
    }
  },
  "deliveries": {
    "additionalProp1": {
      "timestamp": "CURRENT_TIMESTAMP",
      "queueId": "string",
      "relay": "string",
      "deliveryStatusNotification": {
        "success": true,
        "persistentTransientFailure": true,
        "permanentError": true,
        "subject": 0,
        "detail": 0,
        "statusCode": "string",
        "statusDescription": "string"
      },
      "status": "string",
      "relayStatus": "string",
      "delay": "2025-12-10T10:39:12.201Z",
      "recipient": "string"
    },
    "additionalProp2": {
      "timestamp": "CURRENT_TIMESTAMP",
      "queueId": "string",
      "relay": "string",
      "deliveryStatusNotification": {
        "success": true,
        "persistentTransientFailure": true,
        "permanentError": true,
        "subject": 0,
        "detail": 0,
        "statusCode": "string",
        "statusDescription": "string"
      },
      "status": "string",
      "relayStatus": "string",
      "delay": "2025-12-10T10:39:12.201Z",
      "recipient": "string"
    },
    "additionalProp3": {
      "timestamp": "CURRENT_TIMESTAMP",
      "queueId": "string",
      "relay": "string",
      "deliveryStatusNotification": {
        "success": true,
        "persistentTransientFailure": true,
        "permanentError": true,
        "subject": 0,
        "detail": 0,
        "statusCode": "string",
        "statusDescription": "string"
      },
      "status": "string",
      "relayStatus": "string",
      "delay": "2025-12-10T10:39:12.201Z",
      "recipient": "string"
    }
  },
  "hasAttachments": "string",
  "headers": {
    "to": [
      "string"
    ],
    "cc": [
      "string"
    ],
    "bcc": [
      "string"
    ],
    "replyTo": [
      "string"
    ],
    "date": "2025-12-10T10:39:12.201Z",
    "helo": "string",
    "received": [
      "string"
    ],
    "from": "string",
    "fromName": "string",
    "fromAddress": "string",
    "internetMessageId": "string",
    "spfValid": true,
    "dkimValid": true,
    "dmarcValid": true,
    "authenticationResults": {},
    "smtpAuthUser": "string"
  },
  "deliveryResult": "string"
}

You can found more detailed informations in the /messages-journal API documentation directly from the web interface of your appliance. (add https://$hostname in front of the path page).