[Fortinet] Separate Fortinet FortiMail into own Integration (#3266)

* Separate Fortinet FortiMail into own Integration

* update Changelog

* update codeowners

* update dataset field and format

* update to ECS 8.3

* update sample event

* not needed

Author: legoguy1000

.github/CODEOWNERS

@@ -66,6 +66,7 @@
 /packages/fortinet @elastic/security-external-integrations
 /packages/fortinet_forticlient @elastic/security-external-integrations
 /packages/fortinet_fortigate @elastic/security-external-integrations
+/packages/fortinet_fortimail @elastic/security-external-integrations
 /packages/gcp @elastic/security-external-integrations @elastic/obs-cloud-monitoring
 /packages/gcp_pubsub @elastic/security-external-integrations
 /packages/github @elastic/security-external-integrations

packages/fortinet_fortimail/_dev/build/build.yml

@@ -0,0 +1,3 @@
+dependencies:
+  ecs:
+    reference: [email protected]

packages/fortinet_fortimail/_dev/build/docs/README.md

@@ -0,0 +1,15 @@
+# Fortinet FortiMail Integration
+
+This integration is for Fortinet FortiMail logs sent in the syslog format.
+
+## Compatibility
+
+This integration has been tested against FortiOS version 6.0.x and 6.2.x. Versions above this are expected to work but have not been tested.
+
+### Log
+
+The `log` dataset collects Fortinet FortiMail logs.
+
+{{event "log"}}
+
+{{fields "log"}}

packages/fortinet_fortimail/_dev/deploy/docker/docker-compose.yml

@@ -0,0 +1,18 @@
+version: '2.3'
+services:
+  fortinet-logfile:
+    image: alpine
+    volumes:
+      - ./sample_logs:/sample_logs:ro
+      - ${SERVICE_LOGS_DIR}:/var/log
+    command: /bin/sh -c "cp /sample_logs/* /var/log/"
+  fortinet-fortimail-tcp:
+    image: docker.elastic.co/observability/stream:v0.7.0
+    volumes:
+      - ./sample_logs:/sample_logs:ro
+    command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9514 -p=tcp /sample_logs/fortinet-fortimail.log
+  fortinet-fortimail-udp:
+    image: docker.elastic.co/observability/stream:v0.7.0
+    volumes:
+      - ./sample_logs:/sample_logs:ro
+    command: log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9515 -p=udp /sample_logs/fortinet-fortimail.log

packages/fortinet_fortimail/_dev/deploy/docker/sample_logs/fortinet-fortimail.log

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "1.0.0"
+  changes:
+    - description: Initial version of Fortinet FortiMail as separate package
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/3266

packages/fortinet_fortimail/changelog.yml

@@ -0,0 +1,3 @@
+fields:
+  tags:
+    - preserve_original_event