- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Searching for possible spam
Hi,
I'm trying to come up with a search that would help identify spam.
It would have to look at sender domain and count recipients.
In other words if a particular domain is sending n- messages to multipole recipients inhouse, within a particualar time frame, i'd like to be alerted or be able to search for this activity.
Any help would be greatly appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Mostly spam comes from eMails in my case we are using,
index=mail [search index=* attach*|fields message_id ] | rex field=_raw "(?im)ATTACH|(?P.+)" | rex field=_raw "(?im)ATTACHFILTER|(?P.+)" |rex "(?im)IRCPTACTION|(?P.+)"|rex "(?im)SENDER|(?P.+)"| rex "(?im)IRCPTACTION|(?P\w+@\w+.\w+)|(?P\w+)" | stats count values(suspicious_file) as suspicious_file values(malicious_sender) as malicious_sender values(recipient_user) as recipient values(_raw) values(action) as action by message_id _time | sort - count| search action=deliver|table message_id _time malicious_sender suspicious_file recipient
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Other than running proper spam detection such as spam assassin and splunking its results, you could do your approach by setting up an alert triggered by something like this:
search for mails going to inhouse recipients | stats count by sender_domain | where count > n
The exact search depends on your data.
