Monitoring for Emails Sent Externally

[ccolbert]

Hello, 

I am looking for assistance developing a Splunk query that will display all users within my organization that have sent 5+ emails to either gmail, yahoo, or hotmail domains within the past hour. 

As an example, if John in Accounting has submitted his resignation and is now performing a data dump by sending small amounts (to evade detection) of data home, I would like to be alerted immediately. 

[richgalloway · Accepted solution]

See the Splunk Security Essentials app for the "Flight Risk Emailing" use case.