topic Re: Can Splunk help me find out who has read a specific email (Exchange) in All Apps and Add-ons

Can Splunk help me find out who has read a specific email (Exchange)

aleem — Fri, 15 Jul 2016 13:33:30 GMT

We send a company newsletter out to thousands of employees. We would like to know who has read the newsletter. It is simply embedded in an email. Newsletter read means the email status goes from 'unread' to 'read'.

I would hope to present the email ID for the newsletter email to the exchange server and it would give me a list of who has read it or at least a count of who has read it.

Wondering if the App for Microsoft Exchange would do the job or if there is another way.

Thanks
Aleem

Re: Can Splunk help me find out who has read a specific email (Exchange)

woodcock — Fri, 15 Jul 2016 13:49:38 GMT

post a sample of an "email read" log/event.

Re: Can Splunk help me find out who has read a specific email (Exchange)

aleem — Fri, 15 Jul 2016 14:30:20 GMT

Hi Greg,
I don't have a log at this point. I am not even sure what log files might exist as I have no knowledge around Exchange. I am trying to figure out if Splunk would be able to help me by interrogating Exchange.

Thanks
Aleem

Re: Can Splunk help me find out who has read a specific email (Exchange)

sheamus69 — Fri, 15 Jul 2016 15:02:57 GMT

Hi Aleem,

I think that outlook/exchange effectively treat read receipts as an email, so you might be able to search for those messages specifically in the mail logs?

This would assume (yeah, i know ass-u-me!) That end users hadn't turned off reply to read receipts in outlook...

Gareth

Re: Can Splunk help me find out who has read a specific email (Exchange)

aleem — Fri, 15 Jul 2016 15:09:43 GMT

Hi Garth,
We are avoiding read receipts 😉

I guess that the marking of an email from being 'unread' to 'read' is an event with Exchange. I have no idea where this would be 'recorded'. Splunk seems ideal for this depending what it has access to.

Thanks
Aleem

Re: Can Splunk help me find out who has read a specific email (Exchange)

sheamus69 — Fri, 15 Jul 2016 15:23:29 GMT

I haven't supported Exchange since the 5.5 days (the dark ages) - but this seems to suggest its doable if the correct level of auditing is turned on.