---
title: "Email Security Appliance (ESA)"
url: "https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/cisco/esa/"
last_modified: "2026-05-12T12:48:47+02:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/0.86/llms.txt).

# Email Security Appliance (ESA)

Email Security Appliance (ESA):
Protects email systems from spam, phishing, malware, and data loss with advanced threat filtering.

To onboard such a source to Axoflow, complete the [generic appliance onboarding steps](https://axoflow.com/docs/axoflow/0.86/data-sources/appliances/index.md).

Note that the device can be configured to send plain-text syslog or CEF-formatted logs. AxoRouter can automatically parse all flavors.

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| label | Value |
| --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.vendor) |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.product) |
| `service` | [`meta.service.name`](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.service.name) |

You can use the labels as:

- **Filter labels** on the [Analytics page](https://axoflow.com/docs/axoflow/0.86/metrics/analytics/index.md),
- in the **Filter By Label** field during [log tapping](https://axoflow.com/docs/axoflow/0.86/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/0.86/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype, index, and source settings:

| sourcetype | index | source |
| --- | --- | --- |
| cisco:esa:http | email | esa:http |
| cisco:esa:textmail | email | esa:textmail |
| cisco:esa:amp | email | esa:amp |
| cisco:esa:antispam | email | esa:antispam |
| cisco:esa:system_logs | email | esa:system_logs |
| cisco:esa:system_logs | email | esa:euq_logs |
| cisco:esa:system_logs | email | esa:service_logs |
| cisco:esa:system_logs | email | esa:reportd_logs |
| cisco:esa:system_logs | email | esa:sntpd_logs |
| cisco:esa:system_logs | email | esa:smartlicense |
| cisco:esa:error_logs | email | esa:error_logs |
| cisco:esa:error_logs | email | esa:updater_logs |
| cisco:esa:content_scanner | email | esa:content_scanner |
| cisco:esa:authentication | email | esa:authentication |
| cisco:esa:http | email | esa:http |
| cisco:esa:textmail | email | esa:textmail |
| cisco:esa:amp | email | esa:amp |
| cisco:esa | email | program: <variable> |
| cisco:esa:cef | email | esa:consolidated |

Tested with: [Splunk Add-on for Cisco ESA](https://splunkbase.splunk.com/app/1761)

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a [flow processing step](https://axoflow.com/docs/axoflow/0.86/data-management/processing/index.md#set-fields) manually (by setting the `meta.destination.splunk.source` field), AxoRouter automatically sets the source to the [name of the AxoRouter connector](https://axoflow.com/docs/axoflow/0.86/reference/message-schema/reference/index.md#meta.connector.name) that received the message (for example, `axorouter-syslog-tcp-514`).

## Sending data to Google SecOps

When sending the data collected from this source to a [*dynamic* Google SecOps destination](https://axoflow.com/docs/axoflow/0.86/destinations/google/secops/index.md), Axoflow sets the following log type: `CISCO_EMAIL_SECURITY`.

## Sending data to Microsoft Sentinel

When sending the data collected from this source to a [Microsoft Sentinel destination](https://axoflow.com/docs/axoflow/0.86/destinations/microsoft/sentinel/index.md), Axoflow normalizes the data and sends it to the following table: `Syslog`.