Values of fields in the body of CEF messages for classes of Quarantine group events

In the body of CEF messages for classes of Quarantine group events, you can use keys in accordance with their semantics (see the table below).

Permissible values of the fields for classes of Quarantine group events

Key	Value
cs1	Message ID.
cs1Label	Its value is always `MessageId`.
cs2	List of rules separated with commas.
cs2Label	Its value is always `Rules`.
cs3	Account under which the action was performed on the message.
cs3Label	Its value is always `Account`.
src	IP address from which the message was received.
duser	List of message recipients.
suser	Mail sender.
act	Action performed on the message (`proceed` / `delete`).

Each class of Quarantine group events can contain only keys that are relevant to it (see the table below).

Relevant keys for classes of Quarantine group events

Event class	Relevant keys
LMS_EV_ASP_QUARANTINE	cs1, cs1Label, src, suser, cs3, cs3Label, act
LMS_EV_KATA_QUARANTINE	cs1, cs1Label, cs2, cs2Label, suser, duser, act, cs3, cs3Label