The app Trend Micro Email Security (Formely TMES) can help with a variety of situations. You can make a query faster than connect to TMES management console. You can generate a report for e-mails threats in a specific time and create many kinds of alerts. You need to configure the port 1512 TCP and syslog sourcetype in splunk data input. If you need more information, please contact us by splunk community platform. This is an Open Source community project initially built by Anderson Silva. For bug reports or feature requests for this project specifically, please open an issue. Please be specific about what you're trying to do, your system, and steps to reproduce the problem. You are welcome to contribute -> https://github.com/nltt-br/EmailSecurityForSplunk.