How to create a dashboard that shows the total number of emails stopped by reputation filter Ironport?

[Ghanayem1974]

I want to create a dashboard that shows the total number of emails stopped by IronPort, along with Invalid recipients, spam but I am not sure what search I should start with.

[adonio · Accepted solution]

hello there
onboard the ironport logs
leverage pre-built splunk apps for cisco: (i think this is the proper one)
https://splunkbase.splunk.com/app/1761/#/overview
read about the app here:
http://docs.splunk.com/Documentation/AddOns/latest/CiscoESA/About
search the data and the interesting fields and build your queries for panels in dashboard
or download the cisco security suite https://splunkbase.splunk.com/app/525/
which has some pre-built dashboards around your use case

example:

hope it helps