Search for all email files

New Member


how would I detect and monitor processes and command-line arguments for actions that could be taken to gather local email files. For example, I want to be alerted if an adversary gathers or moves email files. Most email files have .eml, .pst, .ost extension. I thought about doing regex search for all the files ending with that extension. What do you think?


Labels (2)
0 Karma


What data / events are you planning on searching for this information? Is it already in splunk in some form? Or is it a question more about how you would gather this information in the first place, e.g. keystroke trace on your adversary's device? 🙂

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...