Hello, I am trying to run a search to get the "EmailFromAddress" of a specific user within ironport.
Can someone please provide the search that would produce that result, please.
For example, I want to know all the from emails that came from user "Joe.Smith@deomain.com"
Any assistance in this regard will be really appreciated!
Thank you in advance for all your help.
@cosmo360 can you share your logs please. Id the emailfromaddress parsed or you need to extract it?
What is the format of your ironport log events? Can you share a sanitized version of a few events?