topic Re: How to detect email attachment content, size, name, etc from Microsoft Exchange server logs? in Getting Data In

How to detect email attachment content, size, name, etc from Microsoft Exchange server logs?

JScordo — Thu, 08 Sep 2016 18:41:56 GMT

I have been tasked with increasing the logging coming from our Exchange servers. One of the requests is to include logging of email attachment content, size, name, or anything else I can collect. I have read the blog post on this found here: http://blogs.splunk.com/2013/12/02/detecting-attachments-in-microsoft-exchange-server-2013/

But I was wondering if there are any alternative ways to doing this, or if anyone had specific instructions on how to get this done (I would like to limit the time our exchange guys need to work on this)

Thank you

Re: How to detect email attachment content, size, name, etc from Microsoft Exchange server logs?

sheamus69 — Tue, 01 Aug 2017 15:50:38 GMT

Did you resolve this issue? I'm facing a similar activity at the moment...

Re: How to detect email attachment content, size, name, etc from Microsoft Exchange server logs?

adonio — Fri, 04 Aug 2017 10:02:24 GMT

I think that this must be configured in exchange.
if the attachment is not being logged, there is no way for Splunk to alert on it.
however, there are other technologies that might be in your possession that can get that data. Cisco ESA (Ironport) and i believe that plenty other tools as well. in most of those tools, you will have ot enable that collection as well.
here is a short version of how to do so in ESA:
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118808-technote-esa-00.html
https://supportforums.cisco.com/discussion/12311151/attachment-name-na-message-tracking
hope it helps

Re: How to detect email attachment content, size, name, etc from Microsoft Exchange server logs?

JScordo — Mon, 07 Aug 2017 16:01:07 GMT

Not yet, our team updated from exchange 2010 to o365 so now I have a whole new bag of issues.