Getting Data In

How to detect email attachment content, size, name, etc from Microsoft Exchange server logs?

JScordo
Path Finder

I have been tasked with increasing the logging coming from our Exchange servers. One of the requests is to include logging of email attachment content, size, name, or anything else I can collect. I have read the blog post on this found here: http://blogs.splunk.com/2013/12/02/detecting-attachments-in-microsoft-exchange-server-2013/

But I was wondering if there are any alternative ways to doing this, or if anyone had specific instructions on how to get this done (I would like to limit the time our exchange guys need to work on this)

Thank you

0 Karma

adonio
Ultra Champion

I think that this must be configured in exchange.
if the attachment is not being logged, there is no way for Splunk to alert on it.
however, there are other technologies that might be in your possession that can get that data. Cisco ESA (Ironport) and i believe that plenty other tools as well. in most of those tools, you will have ot enable that collection as well.
here is a short version of how to do so in ESA:
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118808-technote-esa-00.h...
https://supportforums.cisco.com/discussion/12311151/attachment-name-na-message-tracking
hope it helps

0 Karma

sheamus69
Communicator

Did you resolve this issue? I'm facing a similar activity at the moment...

0 Karma

JScordo
Path Finder

Not yet, our team updated from exchange 2010 to o365 so now I have a whole new bag of issues.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...