Splunk Enterprise Security

Unable to create the alert in ES App

deepak007
Explorer

I tried creating an ES App alert to detect if anyone is sending emails to the mentioned blacklisted domains, but its showing me an error

| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where 'recept'=(@gproxy10-pub.mail.unifiedlayer.com or @Anonymous.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)

Error I am getting
Error in 'where' command: The expression is malformed. An unexpected character is reached at '@gproxy10-pub.mail.unifiedlayer.com or @Anonymous.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)'.

0 Karma

p_gurav
Champion

Hi,

Try somthing like this:

| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com" OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")

deepak007
Explorer

Error in 'where' command: The expression is malformed. Expected ).

0 Karma

p_gurav
Champion
| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com") OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")
0 Karma

deepak007
Explorer

query did work, but not giving the correct data, it is giving all the sources, however I only need the mentioned ones

0 Karma

p_gurav
Champion

Can you share some sample recipient data ?

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...