Good day. I am trying to explicitly categorize the known e-mail servers in my network so that a notable alarm is not triggered when the system is detected sending email (Alert: Host Sending Excessive Email). The correlation search for that alarm will ignore any host that is categorized as “email_servers” within the src_category field in the "Email" Data Model. Initially I tried to add the categorization with lookups (Reference: http docs.splunk.com/Documentation/ES/4.7.4/Admin/Verifyassetandidentitydata), which is categorizing the e-mail systems when I perform this search => "|makeresults |eval src=”192.168.0.1” |`get_asset(src)"
However, the systems identified in the src_category field in the Email data model are not being populated. And therein lies the problem. If the known email servers are being categorized in the data model, then the correlated search will ignore those systems and not trigger an alert. To verify, I unaccelerate the Email DM, edit the src_category within the DM and then perform a preview. The preview populates with events, but none of the known email servers defined in the lookup csv I imported are being categorized within the DM. I also attempted to rebuild the DM and that didn't work either.
I think I am on the right track for tuning out these alarms by categorizing the e-mail servers; however, I’m missing something in regards to actually populating the category within the Data Model. I am looking for some assistance with pointing me in the right direction for getting the data model to categorized the known email_servers. Thank you in advance for any assistance you can provide.
