topic Re: Email in Alerting

Email

isin67 — Sat, 20 Mar 2021 04:31:20 GMT

I like to make alert when ever i am opening my email weather i give correct password or the wrong password no matter what is it possible using splunk tool ?

Re: Email

richgalloway — Sat, 20 Mar 2021 12:33:44 GMT

If your email server logs successful and failed login attempts AND those logs are sent to Splunk then, yes, it is possible to make an alert for that.

Create a search for your email login attempts. When you have the desired results, click the Save As link and choose Alert.

Re: Email

isin67 — Mon, 22 Mar 2021 13:14:46 GMT

may i know how exactly i search for email login attempts and sent to splunk tool?

Re: Email

richgalloway — Mon, 22 Mar 2021 14:45:29 GMT

Exactly? No, I can't tell you exactly how to search because there are too many unknowns (like index names, sourcetype, user names, etc.). Someone at your company should know where the data resides in Splunk so you can find it.

Also see https://docs.splunk.com/Documentation/Splunk/8.1.3/Search/GetstartedwithSearch and https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html