Splunk Enterprise Security

input lookup file to search email traffic

hbfblueteam
New Member

Hi,

I am new to Splunk.

I have an input lookup file with some high risk internal email addresses in it . I want to build an alert which will trigger every time one of these addresses receives an external email with specific words in the subject line.

Index: mail
Lookup name: email_addresses.csv
Default Field for email address: recipient
Words in subject to look for: Payment, Account, Invoice

Any assistance would be much appreciated

Cheers,

0 Karma
1 Solution

starcher
SplunkTrust
SplunkTrust

Build your base search for the index and sourcetype.
Make a wildcard lookup for the subject line.
Use a pattern like this

 index=mail sourcetype=PUTVALUEHERE | lookup emailaddresslookup receipt OUTPUT receipt as isFound | where isnotnull(isFound) | lookup emailsubjects subject OUTPUT subject as isFound | where isnotnull(isFound)

View solution in original post

0 Karma

starcher
SplunkTrust
SplunkTrust

Build your base search for the index and sourcetype.
Make a wildcard lookup for the subject line.
Use a pattern like this

 index=mail sourcetype=PUTVALUEHERE | lookup emailaddresslookup receipt OUTPUT receipt as isFound | where isnotnull(isFound) | lookup emailsubjects subject OUTPUT subject as isFound | where isnotnull(isFound)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...