Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →To investigate suspicious email activity or possible unauthorized administration in FortiMail, identify the installed release and available log coverage first, then correlate message, detection, quarantine, and system-event records. FortiMail logs can show what the appliance recorded and how it handled a message; they cannot, by themselves, prove that a user opened it or that a mailbox or endpoint was compromised.
Start by identifying the version and preserving the evidence
Before filtering records, note the FortiMail model or virtual-machine deployment, software release, investigation window and timezone, protected domains, and the appliance’s mail-flow role. Record which log destinations are configured and how far back records are available. FortiMail logs may be stored locally or sent to remote destinations such as Syslog or FortiAnalyzer; what you can export and review depends on the installation’s configuration and retention.
As an Amazon Associate I earn from qualifying purchases.
Export relevant records before changing filters or configuration. Keep original timestamps and available message context, and document any periods for which logs are missing or unavailable. An absent entry is not proof that an event did not occur: logging can be configured by severity, and the available documentation does not establish the completeness or retention of a particular installation. See Fortinet’s FortiMail 7.6.3 administration guide and confirm behavior against documentation matching the installed release.
Recommended Free Tools
Which FortiMail records should you review?
Use the event that prompted the investigation—such as a suspicious sender, recipient, subject, message identifier, delivery symptom, or approximate time—to guide the search. Fortinet documents several relevant log families, though their exact names and availability can vary by release.
#1 Best Overall
| Record family | What it can help establish |
|---|---|
| History and statistics | Email traffic through the appliance. |
| System events | System-management activity, configuration changes, and administrator or user logins and logouts. |
| Mail events | Events involving webmail, SMTP, POP3, and IMAP. |
| Antispam records | Spam-related detections and the associated recorded handling, where present. |
| Antivirus records | Virus-related detections and the associated recorded handling, where present. |
| Encryption events | Events associated with email encryption. |
Look for unexpected access or configuration activity alongside unusual mail flow and detections that do not fit the intended policy. Treat these as leads to investigate, not proof of compromise. Fortinet describes the log families and record structure in its 7.6.3 administration guide.
Correlate suspicious email activity by session ID
When a record includes a session ID, use it to connect relevant email-related entries rather than relying on one alert in isolation. Fortinet states that email-related logs include a session identification number in the log’s session ID field, and that the ID can help gather information across relevant log types. Depending on what the appliance recorded, compare the same session across history, mail-event, antispam, and antivirus records.
Rank #2
- Pass the Securing Email with Email Security Appliance 300-720 SESA with updated flashcards packed with detailed content aligned to the latest exam blueprint. Cover all core topics without the overload found in lengthy study guides. Get 300+ Securing Email with Email Security Appliance 300-720 SESA flashcards on 8-1/2″ x 11″ perforated card stock.
Preserve the correlated source records and their timestamps. A session ID helps link records; it does not establish that every record type was enabled, retained, or generated for that message.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How can you tell whether FortiMail blocked or quarantined a message?
Read the relevant message and detection records for both the reason FortiMail recorded and the action it took. Fortinet describes a log message as having a header with date and time, log identifier, type, and severity, followed by a body describing why the record was created and the actions taken. The fields vary by log type, so verify their meaning in the log reference for your installed version.
Rank #3
- Pass the Securing Email with Email Security Appliance with updated flashcards packed with detailed content aligned to the latest exam blueprint. Cover all core topics without the overload found in lengthy study guides. Get 300+ Securing Email with Email Security Appliance flashcards on 8-1/2″ x 11″ perforated card stock.
Where the records provide an action, determine whether the message was accepted, rejected, deferred, modified, forwarded, blocked, or quarantined. Then compare that entry with surrounding message-flow records and any associated quarantine state. A detection alone does not show that delivery was prevented, and a logged action should be interpreted in the context of the version-specific field definitions.
Check quarantine state and access limits
Fortinet’s FortiMail 7.6.5 guidance covers personal, system, and domain quarantine. It describes system quarantine as administrator-reviewed and says it can be accessed through the administrative GUI or IMAP using the system quarantine account; POP3 and webmail are not supported for system-quarantine access. Check the relevant records and current message state to distinguish a message that remained withheld from one that was released or deleted. Preserve available message identifiers and headers before taking action. The quarantine mode, access controls, and available records depend on configuration and release. See the FortiMail 7.6.5 administration guide.
Rank #4
- XGS 108 with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- 6 x 2.5 GE copper ports and 1 SFP fiber port, supporting up to 12.5 Gbps firewall performance for growing business networks.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
Can you find out who changed FortiMail settings?
Review system-event records for administrator and user logins and logouts, system-management activity, and configuration changes. Compare the entries with the time window for suspicious message activity. If a configuration change or login appears unexpected, preserve the record and include it in the incident timeline; an entry identifies activity recorded by the appliance, but interpretation may require checking it against authorized change records and the organization’s identity or access logs.
Build a timeline and assess what the records establish
Arrange correlated message, detection, quarantine, and system-event records by timestamp. For each finding, note the source record, the recorded reason or action, and any coverage or retention gap that limits confidence. Separate what FortiMail directly recorded from conclusions that require evidence from other systems.
Best Value
- XGS 88W with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- Built in Wi Fi 6 with 4 x 2.5 GE copper ports, delivering up to 9.9 Gbps firewall performance for secure wired and wireless networks.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
If the records suggest unauthorized administration, suspicious delivery, malware, or business email compromise, preserve the relevant FortiMail exports and coordinate with incident response and the mail-platform team. Investigate connected identities, mailboxes, endpoints, and upstream or downstream systems as appropriate. FortiMail logs alone cannot establish what a user did after delivery or prove compromise elsewhere.
Use documentation that matches the installed release
Fortinet’s documentation page lists FortiMail 8.0.0 administration-guide updates dated July 2, 2026, log-reference updates dated May 22, 2026, and release notes dated June 4, 2026. The detailed logging guidance cited here is for 7.6.3, while the quarantine guidance is for 7.6.5. These references do not indicate which version a particular organization runs. Confirm the appliance’s release and use its matching documentation before relying on exact navigation, field meanings, or feature behavior. The FortiMail documentation page lists the available version-specific materials.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
