https://community.splunk.com/t5/Splunk-Search/Searching-for-possible-spam/m-p/80804#M20428 <P>Mostly spam comes from eMails in my case we are using,</P> <P>index=mail [search index=* attach*|fields message_id ] | rex field=_raw "(?im)ATTACH|(?P.+)" | rex field=_raw "(?im)ATTACHFILTER|(?P.+)" |rex "(?im)IRCPTACTION|(?P.+)"|rex "(?im)SENDER|(?P.+)"| rex "(?im)IRCPTACTION|(?P\w+@\w+.\w+)|(?P\w+)" | stats count values(suspicious_file) as suspicious_file values(malicious_sender) as malicious_sender values(recipient_user) as recipient values(_raw) values(action) as action by message_id _time | sort - count| search action=deliver|table message_id _time malicious_sender suspicious_file recipient</P> Tue, 29 Sep 2020 10:31:11 GMT neelamsantosh 2020-09-29T10:31:11Z https://community.splunk.com/t5/Splunk-Search/Searching-for-possible-spam/m-p/80802#M20426 <P>Hi, <BR /> I'm trying to come up with a search that would help identify spam. </P> <P>It would have to look at sender domain and count recipients.<BR /> In other words if a particular domain is sending n- messages to multipole recipients inhouse, within a particualar time frame, i'd like to be alerted or be able to search for this activity.<BR /> Any help would be greatly appreciated.</P> Mon, 01 Apr 2013 14:52:27 GMT https://community.splunk.com/t5/Splunk-Search/Searching-for-possible-spam/m-p/80802#M20426 zabarai 2013-04-01T14:52:27Z https://community.splunk.com/t5/Splunk-Search/Searching-for-possible-spam/m-p/80803#M20427 <P>Other than running proper spam detection such as spam assassin and splunking its results, you could do your approach by setting up an alert triggered by something like this:</P> <PRE><CODE>search for mails going to inhouse recipients | stats count by sender_domain | where count &gt; n </CODE></PRE> <P>The exact search depends on your data.</P> Mon, 01 Apr 2013 15:41:04 GMT https://community.splunk.com/t5/Splunk-Search/Searching-for-possible-spam/m-p/80803#M20427 martin_mueller 2013-04-01T15:41:04Z https://community.splunk.com/t5/Splunk-Search/Searching-for-possible-spam/m-p/80804#M20428 <P>Mostly spam comes from eMails in my case we are using,</P> <P>index=mail [search index=* attach*|fields message_id ] | rex field=_raw "(?im)ATTACH|(?P.+)" | rex field=_raw "(?im)ATTACHFILTER|(?P.+)" |rex "(?im)IRCPTACTION|(?P.+)"|rex "(?im)SENDER|(?P.+)"| rex "(?im)IRCPTACTION|(?P\w+@\w+.\w+)|(?P\w+)" | stats count values(suspicious_file) as suspicious_file values(malicious_sender) as malicious_sender values(recipient_user) as recipient values(_raw) values(action) as action by message_id _time | sort - count| search action=deliver|table message_id _time malicious_sender suspicious_file recipient</P> Tue, 29 Sep 2020 10:31:11 GMT https://community.splunk.com/t5/Splunk-Search/Searching-for-possible-spam/m-p/80804#M20428 neelamsantosh 2020-09-29T10:31:11Z