Hello,
I am looking for assistance developing a Splunk query that will display all users within my organization that have sent 5+ emails to either gmail, yahoo, or hotmail domains within the past hour.
As an example, if John in Accounting has submitted his resignation and is now performing a data dump by sending small amounts (to evade detection) of data home, I would like to be alerted immediately.
