Alerting if a sending domain doesnt match the CSV file

[Bryan_Rye]

Hello. I have a search that looks like this:

sourcetype="sendmail_syslog" host=*-ess-css* | stats count by search_from_domain

It lists all of the sending domains through a set of email hosts. I also configured a csv file that lists the valid sending email domains. I've imported the file under the lookups folder and I can return results by running "|inputlookup css_domains.csv" of the valid domains.

I need help creating the search that will compare the search results to the csv file as well as the sending IP address and alert if the domain is not in the csv file.

Can you help me structure the search?

[martin_mueller]

I'm assuming you have a CSV file something like this:

domain,is_valid
mydomain,yes
otherdomain,no

Define an automatic lookup that links domain from the CSV file to your events' domain field, adding the is_valid field to each event. Then it's just a matter of filtering by NOT is_valid="yes".