Knowledge Management

ES Tuning Question - Trying to Catagorize Known Email Servers


Good day. I am trying to explicitly categorize the known e-mail servers in my network so that a notable alarm is not triggered when the system is detected sending email (Alert: Host Sending Excessive Email). The correlation search for that alarm will ignore any host that is categorized as “email_servers” within the src_category field in the "Email" Data Model. Initially I tried to add the categorization with lookups (Reference: http, which is categorizing the e-mail systems when I perform this search => "|makeresults |eval src=”” |`get_asset(src)"

However, the systems identified in the src_category field in the Email data model are not being populated. And therein lies the problem. If the known email servers are being categorized in the data model, then the correlated search will ignore those systems and not trigger an alert. To verify, I unaccelerate the Email DM, edit the src_category within the DM and then perform a preview. The preview populates with events, but none of the known email servers defined in the lookup csv I imported are being categorized within the DM. I also attempted to rebuild the DM and that didn't work either.

I think I am on the right track for tuning out these alarms by categorizing the e-mail servers; however, I’m missing something in regards to actually populating the category within the Data Model. I am looking for some assistance with pointing me in the right direction for getting the data model to categorized the known email_servers. Thank you in advance for any assistance you can provide.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...