input lookup file to search email traffic

[hbfblueteam]

Hi,

I am new to Splunk.

I have an input lookup file with some high risk internal email addresses in it . I want to build an alert which will trigger every time one of these addresses receives an external email with specific words in the subject line.

Index: mail
Lookup name: email_addresses.csv
Default Field for email address: recipient
Words in subject to look for: Payment, Account, Invoice

Any assistance would be much appreciated

Cheers,

[starcher · Accepted solution]

Build your base search for the index and sourcetype.
Make a wildcard lookup for the subject line.
Use a pattern like this

 index=mail sourcetype=PUTVALUEHERE | lookup emailaddresslookup receipt OUTPUT receipt as isFound | where isnotnull(isFound) | lookup emailsubjects subject OUTPUT subject as isFound | where isnotnull(isFound)