Hello, I'd like to ask the community, if there is possible to index somehow the body of e-mails sent through MS Exchange 2010. I like to consider Splunk as possible DLP for e-mails. Thank you, Kamil
http://answers.splunk.com/answers/50048/splunk-consuming-email-alerts-from-other-monitoring-tools
Something like this should get the emails into Splunk. I believe you can create system rules in Exchange to BCC all email to an address.
Let me know if that works for you.
Richard
