Hi, we have a dedicated mailbox to be polled by Splunk.. Currently we have IMAPmailbox, and now we want to add TA-dmarc.
IMAPmailbox is configured to poll INBOX and delete processed items. By the time TA-dmarc will get a chance to do its bit, there will be nothing to process.
For this reason I want to create a subfolder and set up a rule that all DMARC e-mails to be moved to that folder,. This way DMARC emails will not be deleted by IMAPmailbox. Then I want to configure TA-dmarc to poll that subfolder.
Problem: how do I specify a subfolder to poll in the TA_dmarc configuration?
Thanks.
Yes you can specify INBOX.mysubfolder
in the IMAP mailbox parameter when creating a new IMAP input.
Yes you can specify INBOX.mysubfolder
in the IMAP mailbox parameter when creating a new IMAP input.
Thanks jorritf. What I found is that TA-dmarc fails to access the folder when using the dot (".") as separator. Using the slash instead ("/") doesn't generate an error.
I am still struggling to get some reports, but at lease this one is out of the way.