Splunk Search

Phishing emails

of
New Member

Hi,

I want to create a search query that looks for users who have received phishing emails, clicked the link, or downloaded a file from the email.

Thanks

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What events do you have in Splunk to work with?

0 Karma

of
New Member

Hi,

Thanks for your reply. We have a WAF and firewall and ingest their logs in Splunk.

Regards,

 

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

WAF and firewall are typically _not_ solutions associated with email traffic or user's web-related behaviour so you might want to reconsider your sources list.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK so what do those events look like? What data do they contain? Please share some anonymised examples.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...