What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To investigate suspicious activity in FortiMail, first identify the installed version and the log destinations and time range available. Then correlate message history, mail-event, antispam, antivirus, quarantine, and system-event records—using the email session ID where present—and check administrator logins and configuration changes. These records can show what FortiMail recorded and did; they cannot by themselves prove that a recipient opened a message or that a mailbox or endpoint was compromised.
Start by identifying the appliance and preserving available records
Before searching, note the FortiMail model or virtual-machine deployment, installed software version, investigation window and timezone, protected domains, and the appliance’s role in mail flow. Identify which log destinations are configured and how far back records are available. FortiMail logs may be stored locally or sent to remote destinations such as Syslog or FortiAnalyzer; what you can export and how much history exists depends on the deployment and its configuration. See Fortinet’s FortiMail 7.6.3 logging guidance.
- Export relevant records before changing filters or logging settings.
- Record the timezone and any clock differences that could affect the timeline.
- Document the available date range and any apparent gaps.
Do not treat the absence of an entry as proof that an event did not occur. Logging can be configured by severity, and the records available on one installation do not establish the completeness or retention of another.
Which FortiMail logs should you check?
Fortinet describes several log families, though exact categories and labels can vary by release. Review those available on the installed system:
#1 Best Overall
- History and statistics: email traffic through the appliance.
- Mail events: activity involving webmail, SMTP, POP3, and IMAP.
- Antispam and antivirus: detections recorded by those protections.
- System events: management activity, configuration changes, and administrator or user logins and logouts.
- Encryption events: records associated with email encryption.
Begin with a known indicator—such as a suspicious time, sender, recipient, subject, message identifier, or delivery symptom—and search the relevant families. Look for unexpected mail flow, detections, or actions that do not match the intended policy. Treat these as leads to verify across records, not proof of compromise. Fortinet’s logging guide describes the categories and fields.
Correlate email records by session ID
Fortinet states that email-related logs contain a session identification number in the log message’s session ID field. Use that ID to connect relevant records for the same activity—for example, message history with a mail event and any antispam or antivirus record. Not every record will necessarily be present or contain the same useful detail, so retain the original entries and timestamps as well as the correlated view.
Rank #2
- Pass the Securing Email with Email Security Appliance 300-720 SESA with updated flashcards packed with detailed content aligned to the latest exam blueprint. Cover all core topics without the overload found in lengthy study guides. Get 300+ Securing Email with Email Security Appliance 300-720 SESA flashcards on 8-1/2″ x 11″ perforated card stock.
A session ID helps connect FortiMail records; it does not show what happened after delivery in a recipient’s mailbox or on an endpoint.
Recommended Free Tools
How can you tell whether FortiMail blocked or quarantined an email?
Read the relevant message and detection records for both the reason FortiMail logged the event and the action it recorded. Fortinet describes log messages as having a header with date and time, log identifier, type, and severity, followed by a body describing why the record was created and actions taken. Available fields depend on the log type. Confirm field meanings and action labels against the log reference for the installed release.
Rank #3
- Pass the Securing Email with Email Security Appliance with updated flashcards packed with detailed content aligned to the latest exam blueprint. Cover all core topics without the overload found in lengthy study guides. Get 300+ Securing Email with Email Security Appliance flashcards on 8-1/2″ x 11″ perforated card stock.
Where the records support it, establish whether the message was accepted, rejected, deferred, modified, forwarded, blocked, or quarantined. Do not infer delivery or recipient access from a detection alone. Correlate the action with surrounding mail-flow records and check the message’s quarantine state when relevant.
Check quarantine state and access
Fortinet’s FortiMail 7.6.5 quarantine guidance covers personal, system, and domain quarantine. Check the relevant quarantine records and determine whether a message was held, released, or deleted. Preserve available message identifiers and headers before changing its state.
Rank #4
- XGS 108 with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- 6 x 2.5 GE copper ports and 1 SFP fiber port, supporting up to 12.5 Gbps firewall performance for growing business networks.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
In Fortinet’s 7.6.5 guidance, system quarantine is reviewed by an administrator and can be accessed through the administrative GUI or IMAP using the system quarantine account. POP3 and webmail are not supported for system-quarantine access. The actual quarantine mode, controls, and available records depend on the configuration and installed version.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCan you find out who changed FortiMail settings?
Review system-event records for administrator and user logins and logouts, management activity, and configuration changes. Compare the recorded account, time, and change details with the expected maintenance or access history. If the records do not identify a person conclusively, distinguish the account shown in the log from the individual who used it; investigate the associated identity and access records through your organization’s normal incident-response process.
Best Value
- XGS 88W with 1 Year Xstream Protection - Next-generation firewall appliance with Xstream Protection subscription providing zero-day defense, cloud sandboxing, email filtering, intrusion prevention, and advanced reporting, managed through Sophos Central for unified policies and reporting.
- Built in Wi Fi 6 with 4 x 2.5 GE copper ports, delivering up to 9.9 Gbps firewall performance for secure wired and wireless networks.
- Zero day protection with cloud sandboxing, email filtering, and advanced reporting for full enterprise coverage.
- TLS inspection and next generation intrusion prevention block hidden threats in encrypted traffic and stop sophisticated attacks.
- Includes Xstream Protection – Advanced security bundle with zero-day protection, cloud sandboxing, email filtering, and automated threat response, providing full coverage against the most sophisticated cyberattacks.
Build a timeline and assess what the evidence establishes
- Collect the relevant original exports and note their source, timezone, and date range.
- Place suspicious message activity, detections, quarantine changes, administrator logins, and configuration changes in chronological order.
- Use session IDs to connect related email records where available, and keep unlinked records identifiable as such.
- For each finding, record what FortiMail logged, what action it recorded, and what remains unknown because of missing records or limited fields.
- If the evidence suggests unauthorized administration, suspicious delivery, malware, or business email compromise, coordinate with incident responders and the teams responsible for identities, mailboxes, endpoints, and connected mail systems.
FortiMail logs can support an investigation of appliance activity, but they cannot alone establish what a user did after delivery or prove compromise elsewhere.
Use documentation for the installed release
Fortinet’s documentation page lists FortiMail 8.0.0 administration-guide updates dated July 2, 2026, log-reference updates dated May 22, 2026, and release notes dated June 4, 2026. The detailed logging guidance linked above is for 7.6.3, and the quarantine guidance is for 7.6.5. Check Fortinet’s FortiMail documentation page and select material that matches the appliance’s installed release before relying on exact navigation, field names, or feature behavior. The documentation listing does not indicate which version a particular organization runs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
