Reporting

Detecting spam

bryansocito
New Member

Hi All,

I'm creating a dashboard where it will show if 1 email is sent to multiple recipients (spam) - same sender, same subject, multiple recipients. So basically it's a threat detection via email. Is this possible?

alt text

Cheers,
Bryan

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

<your search for email> | stats count(recipient) as recipients by Sender, Subject | where recipients > 3 | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

<your search for email> | stats count(recipient) as recipients by Sender, Subject | where recipients > 3 | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.