Splunk Enterprise Security

Unable to create the alert in ES App

deepak007
Explorer

I tried creating an ES App alert to detect if anyone is sending emails to the mentioned blacklisted domains, but its showing me an error

| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where 'recept'=(@gproxy10-pub.mail.unifiedlayer.com or @Anonymous.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)

Error I am getting
Error in 'where' command: The expression is malformed. An unexpected character is reached at '@gproxy10-pub.mail.unifiedlayer.com or @Anonymous.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)'.

0 Karma

p_gurav
Champion

Hi,

Try somthing like this:

| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com" OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")

deepak007
Explorer

Error in 'where' command: The expression is malformed. Expected ).

0 Karma

p_gurav
Champion
| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com") OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")
0 Karma

deepak007
Explorer

query did work, but not giving the correct data, it is giving all the sources, however I only need the mentioned ones

0 Karma

p_gurav
Champion

Can you share some sample recipient data ?

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...