How to create a Data Protection policy to log the sender's IP address in Email Security.cloud

Products

• Email Security.cloud

Issue/Introduction

You want to log the connecting IP address of a sender for SIEM analysis or audit purposes by adding a custom header to inbound emails.

Environment

Email Security.cloud

Resolution

While the standard 'X-Originating-IP' header is added by default with brackets (e.g., 'X-Originating-IP: [192.0.2.1]'), you can create a Data Protection policy to log the transaction, which will include the IP in the service logs.

1.  Log in to the Email Security.cloud portal and navigate to Services > Data Protection.
2.  Click New Policy.
3.  Name the policy (e.g., "Log Inbound Sender IP").
4. Set Apply to: Inbound emails only.
5. Set the Action to Log Only (this ensures the mail is delivered but the transaction is recorded in your logs).
6. In the Rules section, Add a rule with Content Regular Expression Lists condition.
7. Create a new Regular Expression List. Name it (e.g., "Log Incoming IP"). In the Add list items: section type:
\(((?:\d{1,3}\.){3}\d{1,3})\).*?\n?.*?messagelabs\.com
Press Add button and Save
8.  Under Look in make sure the Header is selected and Matched text is set to Log matched text.

9.  Click Save and Activate the Data Protection Policy.

Note: Data Protection policies can log the event, but they cannot currently "strip" brackets from the system-generated 'X-Originating-IP' header or dynamically insert a "plain" IP into a new header. For SIEM integration, it is recommended to parse the brackets out during the SIEM ingestion phase.