https://community.splunk.com/t5/Security/Monitoring-for-Emails-Sent-Externally/m-p/535226#M12035 <P>Hello,&nbsp;</P><P>I am looking for assistance developing a Splunk query that will display all users within my organization that have sent 5+ emails to either gmail, yahoo, or hotmail domains within the past hour.&nbsp;</P><P>As an example, if John in Accounting has submitted his resignation and is now performing a data dump by sending small amounts (to evade detection) of data home, I would like to be alerted immediately.&nbsp;</P> Fri, 08 Jan 2021 16:00:35 GMT ccolbert 2021-01-08T16:00:35Z https://community.splunk.com/t5/Security/Monitoring-for-Emails-Sent-Externally/m-p/535226#M12035 <P>Hello,&nbsp;</P><P>I am looking for assistance developing a Splunk query that will display all users within my organization that have sent 5+ emails to either gmail, yahoo, or hotmail domains within the past hour.&nbsp;</P><P>As an example, if John in Accounting has submitted his resignation and is now performing a data dump by sending small amounts (to evade detection) of data home, I would like to be alerted immediately.&nbsp;</P> Fri, 08 Jan 2021 16:00:35 GMT https://community.splunk.com/t5/Security/Monitoring-for-Emails-Sent-Externally/m-p/535226#M12035 ccolbert 2021-01-08T16:00:35Z https://community.splunk.com/t5/Security/Monitoring-for-Emails-Sent-Externally/m-p/535244#M12036 <P>See the Splunk Security Essentials app for the "Flight Risk Emailing" use case.</P> Fri, 08 Jan 2021 18:44:06 GMT https://community.splunk.com/t5/Security/Monitoring-for-Emails-Sent-Externally/m-p/535244#M12036 richgalloway 2021-01-08T18:44:06Z