Security

Example of a high volume email activity to non-corporate domains by a user use case?

adukes_splunk
Splunk Employee
Splunk Employee

Does anyone have examples of how to use Splunk to check for volume email activity to non-corporate domains?

0 Karma
1 Solution

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to alert on high volume email activity by a user to non-corporate domains.

Load data

This use case depends on the email data model as defined by the Common Information Model (CIM). For simplicity, this example only uses email data from the Splunk Add-on for Microsoft Exchange but any data properly normalized for the email data model works well. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.

Follow the instructions for the Splunk Add-on for Microsoft Exchange. Specifically, the MessageTracking monitor stanzas within the TA-Exchange-HubTransport and TA-Exchange-Mailbox add-ons bundled with the Splunk Add-on for Microsoft Exchange. Don't forget to deploy the add-ons to the search heads to use Common Information Model to normalize data at search time.

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing High Volume Email Activity to Non-corporate Domains by User, then select the appropriate result from the result set.
  4. Select Submit to display notable events.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events. However, you may need to enable correlation searches or you may need to deploy the add-ons to the search heads to use the knowledge objects necessary for simple searching.

Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable, and relevant content.

Splunk Enterprise Security: Use Case Library

View solution in original post

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.

For more information on this and other examples, download the free Splunk Security Essentials app on Splunkbase.

In this use case, we'll explore how to use Splunk Enterprise Security to alert on high volume email activity by a user to non-corporate domains.

Load data

This use case depends on the email data model as defined by the Common Information Model (CIM). For simplicity, this example only uses email data from the Splunk Add-on for Microsoft Exchange but any data properly normalized for the email data model works well. It’s a best practice to use the CIM to normalize data at search time, but before you put in effort to create new knowledge objects, check Splunkbase to see if such a CIM-compatible app or add-on already exists.

Follow the instructions for the Splunk Add-on for Microsoft Exchange. Specifically, the MessageTracking monitor stanzas within the TA-Exchange-HubTransport and TA-Exchange-Mailbox add-ons bundled with the Splunk Add-on for Microsoft Exchange. Don't forget to deploy the add-ons to the search heads to use Common Information Model to normalize data at search time.

Get insights

This scenario uses the Incident Review dashboard in Splunk Enterprise Security and underlying correlation searches. Use the following procedure to discover incidents:

  1. Navigate to the Splunk Enterprise Security web user interface.
  2. Select Incident Review from the top navigation bar.
  3. Select the text box under Correlation Search, begin typing High Volume Email Activity to Non-corporate Domains by User, then select the appropriate result from the result set.
  4. Select Submit to display notable events.

Review the Overview of Incident Review in Splunk Enterprise Security in Splunk docs for guidance on how to triage and act on resulting incidents. If no results appear, there may not be any notable notable events. However, you may need to enable correlation searches or you may need to deploy the add-ons to the search heads to use the knowledge objects necessary for simple searching.

Watch the following video to see how the Use Case Library in Splunk Enterprise Security can strengthen your security posture and reduce risk with readily available, usable, and relevant content.

Splunk Enterprise Security: Use Case Library

0 Karma

adukes_splunk
Splunk Employee
Splunk Employee

Added related video.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...