topic email from specific domain in Reporting

email from specific domain

rashid47010 — Mon, 18 Feb 2019 13:12:15 GMT

I want to exlude specific domains from both sender and receipient.
for example I have abc.com domain and have one lookup file with legitiamate domain names.
Now I want to see a emails which is not include either as sender or receipient in that lookup file.

OR in simple words how can I compare lookup values againt two fields(sender and receipient)

Re: email from specific domain

vnravikumar — Mon, 18 Feb 2019 14:03:42 GMT

Hi @rashid47010

Try this

| makeresults 
| eval sender="test@test.com" 
| eval receiver="test1@test.com" 
| rex field=sender "@(?P<senderdomain>.*)" 
| lookup domainlookup domain as senderdomain OUTPUT domain as senderflag 
| rex field=receiver "@(?P<receiverdomain>.*)" 
| lookup domainlookup domain as receiverdomain OUTPUT domain as receiverflag 
| where isnull(senderflag) AND isnull(receiverflag)

lookup: domainlookup

domain
abc.com
test.com

Re: email from specific domain

vnravikumar — Tue, 19 Feb 2019 14:27:44 GMT

@rashid47010, have you tried?

Re: email from specific domain

vnravikumar — Thu, 21 Feb 2019 08:43:23 GMT

Its solved?