SmarterMail Add-on

The SmarterMail Add-on for Splunk provides field extractions and Common Information Model (CIM) Email data model mappings for SmarterMail email server logs on Windows. This technology add-on processes and normalizes log data from multiple SmarterMail log types including SMTP, IMAP, POP, delivery, administrative, spam checks, general errors, and activation logs. All events are processed with the sourcetype smartermail:log. The add-on extracts key email-related fields such as sender and recipient addresses, message IDs, delivery actions, protocols, source and destination hosts, message sizes, and subjects. By mapping these fields to the CIM Email data model, the add-on enables correlation searches in Splunk Enterprise Security and facilitates email security monitoring, compliance reporting, and operational troubleshooting across SmarterMail infrastructure. "Note: To ensure proper CIM compliance and use with Splunk Enterprise Security, users must rebuild the Email Data Model Acceleration after installation."