Find Multiple Users With The Same Unknown Email Subject

[pcyr]

Scenario: I have 10 machines infected with malware. The believed infection source is email, I am attempting to create a search to find if any emails with the same subject line or sender have been sent to all 10 individuals.

Basis of search is below, I am just wondering what operator would be used to compare a field to itself and only return the results which are present in the logs of all users .

index=email sourcetype=email
recipient= user1 OR recipient=user2 OR recipient=user3 AND subject="unknown subject that is the same for all recipients"

[pcyr]

Thanks guys, dc worked just as it should have.

[richgalloway · Accepted solution]

Use the stats command to group events by subject then use where to show only those common to all 10 recipients.

index=email sourcetype=email
(recipient= user1 OR recipient=user2 OR recipient=user3) AND subject=*
| stats dc(recipient) as recipCount by subject
| where recipCount=10

[manjunathmeti]

Hi @pcyr,
Use dc OR distinct_count with stats to count distinct values of field recipient.

index=email sourcetype=email recipient IN (user1,user2,user3,user4,...,user10) subject="unknown subject that is the same for all recipients"
| stats dc(recipient) as count 
| where count=10