All Apps and Add-ons

Can the Splunk App for Microsoft Exchange show the contents of the body of an email?

rdamron
Engager

I was wondering if the Splunk App for Microsoft Exchange can show the contents of the body of an email message?
If so, how can I set up a search or alert for this?

0 Karma

jkat54
SplunkTrust
SplunkTrust

I believe the answer is No. You might want to read this thread for methods to do so:

https://community.spiceworks.com/topic/144138-how-to-search-and-view-emails-sent-through-exchange-se...

Disclaimer, I have not ever used this application. Im practically assuming after looking at the application code.

Also I know a bit about Exchange... you'd need permission to read their mailboxes first. Sure any admin can do this, but I seriously doubt (for that reason along) that they built the functionality into the splunk app. Because most users don't care to read other's emails... but also they want their app to work without full access, special permissions, etc. So if you imagine half of the dashboards working but the others don't work until you get an admin service account for exchange setup in the app.... why even include the advanced stuff at that point? You'd probably be better off making 2 apps, one lets you spy on peoples email, and the other lets you monitor exchange for performance issues, etc.

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...