How to detect email attachment content, size, name, etc from Microsoft Exchange server logs?

[JScordo]

I have been tasked with increasing the logging coming from our Exchange servers. One of the requests is to include logging of email attachment content, size, name, or anything else I can collect. I have read the blog post on this found here: http://blogs.splunk.com/2013/12/02/detecting-attachments-in-microsoft-exchange-server-2013/

But I was wondering if there are any alternative ways to doing this, or if anyone had specific instructions on how to get this done (I would like to limit the time our exchange guys need to work on this)

Thank you

[adonio]

I think that this must be configured in exchange.
if the attachment is not being logged, there is no way for Splunk to alert on it.
however, there are other technologies that might be in your possession that can get that data. Cisco ESA (Ironport) and i believe that plenty other tools as well. in most of those tools, you will have ot enable that collection as well.
here is a short version of how to do so in ESA:
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118808-technote-esa-00.h...
https://supportforums.cisco.com/discussion/12311151/attachment-name-na-message-tracking
hope it helps

[sheamus69]

Did you resolve this issue? I'm facing a similar activity at the moment...

[JScordo]

Not yet, our team updated from exchange 2010 to o365 so now I have a whole new bag of issues.