Searching for possible spam

[zabarai]

Hi,
I'm trying to come up with a search that would help identify spam.

It would have to look at sender domain and count recipients.
In other words if a particular domain is sending n- messages to multipole recipients inhouse, within a particualar time frame, i'd like to be alerted or be able to search for this activity.
Any help would be greatly appreciated.

[neelamsantosh]

Mostly spam comes from eMails in my case we are using,

index=mail [search index=* attach*|fields message_id ] | rex field=_raw "(?im)ATTACH|(?P.+)" | rex field=_raw "(?im)ATTACHFILTER|(?P.+)" |rex "(?im)IRCPTACTION|(?P.+)"|rex "(?im)SENDER|(?P.+)"| rex "(?im)IRCPTACTION|(?P\w+@\w+.\w+)|(?P\w+)" | stats count values(suspicious_file) as suspicious_file values(malicious_sender) as malicious_sender values(recipient_user) as recipient values(_raw) values(action) as action by message_id _time | sort - count| search action=deliver|table message_id _time malicious_sender suspicious_file recipient

[martin_mueller]

Other than running proper spam detection such as spam assassin and splunking its results, you could do your approach by setting up an alert triggered by something like this:

search for mails going to inhouse recipients | stats count by sender_domain | where count > n

The exact search depends on your data.