Creating a search to check the if any user has sent more than 100 emails per hour

[singriajay]

Hi Team,

I have used the below search to find the top senders

eventtype=cisco-esa | transaction keepevicted=true icid mid | search host="*" sender="*" recipient="*" dest_interface="*" policy_direction="*" threat_reason="*" | stats count by sender,recipient,threat_reason,host,sender_reputation,policy_direction,_time | top sender 

But I need to create an alert if any sender has sent emails more than 25 per hour

[richgalloway]

If you want an alert when something happens, then you need to search for that something.

eventtype=cisco-esa earliest=-60m 
| transaction keepevicted=true icid mid 
| search host="*" sender="*" recipient="*" dest_interface="*" policy_direction="*" threat_reason="*" 
| stats count, values(recipient) as recipients, values(threat_reason) as threat_reasons, values(host) as hosts, values(sender_reputation) as sender_reputation, values(policy_direction) as policy_direction, values(_time) as _time by sender
| where count>100

[singriajay]

Hi richgalloway,

I wanted to get the count of senders to multiple users; in the above query we get only the count of senders per recipient.

[richgalloway]

The above answer displays "any sender has sent emails more than 25 per hour". To get sender/recipient pairs, try this:

eventtype=cisco-esa earliest=-60m 
 | transaction keepevicted=true icid mid 
 | search host="*" sender="*" recipient="*" dest_interface="*" policy_direction="*" threat_reason="*" 
 | stats count, values(threat_reason) as threat_reasons, values(host) as hosts, values(sender_reputation) as sender_reputation, values(policy_direction) as policy_direction, values(_time) as _time by sender,recipient
 | where count>100