About sulaimancds

sulaimancds · ‎05-16-2023

index=mail [ | inputlookup Updated.csv | rename address AS query | fields query ] | dedup MessageTraceId | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(RecipientAddress) as Recipient values(Subject) as Subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" values(Status) as Status values(EventDate) as Resigned Date by RecipientDomain SenderAddress | eval subject_count=mvcount(Subject) | sort - subject_count | convert ctime("Latest") | convert ctime("Earliest") currently i have this query, which is working well. In the csv , i have another column called event date,. based on the results generated i would like to show the even date as well when running the query.

sulaimancds · ‎04-25-2023

hi please provide me the full command

sulaimancds · ‎04-25-2023

| tstats summariesonly=true max(_time) as lastTime, count FROM datamodel=Change BY "All_Changes.action", "All_Changes.result_id", "All_Changes.user", "All_Changes.dest" | rename "All_Changes.*" as * | search result_id = 4732 | convert ctime(lastTime) as lastTime i am running this command , there is output , but i want to see events and know more details , but events not showing total number of events Complete 590,046 events

sulaimancds · ‎03-15-2023

hi i need to match those sender domain = gmail.com can you help me with the query ? index=mail | dedup MessageTraceId | rex field=SenderAddress "(?<Sender>[^@]*)@(?<SenderDomain>.*)" | where SenderDomain == gmail.com | table SenderDomain SenderAddress RecipientAddress Subject Earliest Latest the 4th line does not work . please help

sulaimancds · ‎03-13-2023

yes i only want to see 1 recipient , if there are 2 recipient i do not want the results to be displayed,

sulaimancds · ‎03-13-2023

i have able to make it work index=mail | dedup Subject | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(RecipientAddress) as Recipient values(Subject) as Subject latest(_time) as "Time" by RecipientDomain SenderAddress | where mvcount(Recipient)=1 | eval subject_count=mvcount(Subject) | sort - subject_count | convert ctime("Time") please check.

sulaimancds · ‎03-13-2023

in events SenderAddress is sender, in raw log Recipient Domain is under INTERESTING FIELDS, which is working when using table command. Please help for the last 3 lines.

sulaimancds · ‎03-13-2023

| table RecipientDomain SenderAddress RecipientAddress Subject Received this work , without any filter. stats does not work only table works like this without any filters. Please help. i try to deubg it is not showing anything under statitics.

sulaimancds · ‎03-13-2023

it does not work index=mail | dedup MessageTraceId | dedup MessageId | dedup subject | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | table RecipientDomain SenderAddress RecipientAddress Subject Received this work , without any filter. stats does not work only table works like this without any filters. Please help.

sulaimancds · ‎03-13-2023

in events i can see, i cannot see anything under statistics.

sulaimancds · ‎03-12-2023

hi index=mail | dedup Subject | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(recipient) AS recipient dc(recipient) AS recipient_count values(subject) AS subject dc(subject) AS subject_count earliest(_time) AS "Earliest" latest(_time) AS "Latest" BY RecipientDomain sender | where recipient_count=1 | sort -subject_count i cannot see anything under statitics.

sulaimancds · ‎03-12-2023

can dedup all in a single line. subject is there. mvcount is there. this is my old command. | stats values(recipient) as recipient values(subject) as subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" by RecipientDomain sender | where mvcount(recipient)=1 | eval subject_count=mvcount(subject) | sort - subject_count i need to move this into my new command , which i first posted.

sulaimancds · ‎03-12-2023

index=mail | dedup MessageTraceId | dedup MessageId | dedup subject | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | table RecipientDomain SenderAddress RecipientAddress Subject Received hi this 3 lines are not working for this query. Please help. | where mvcountRecipientAddress=1 | eval subject_count=mvcount(Subject) | sort - subject_count

sulaimancds · ‎03-12-2023

i need the full recipient email and sender email to be shown in the table only recipient domain will show the domain like google.com, yahoo.com

sulaimancds · ‎03-12-2023

sorry changed the table to Received. this is the raw log Received: 2023-03-13T02:56:22.5381743

sulaimancds · ‎03-12-2023

{"Organization": "groupxyz.onmicrosoft.com", "MessageId": "<12345678>", "Received": "2023-03-13T01:56:22.9207071", "SenderAddress": "bca@bca.com", "RecipientAddress": "dlf@g.com", "Subject": "12312312332231'", "Status": "Delivered", "ToIP": "111.1.11.1", "FromIP": "12.23.4.2.23232", "Size": 2022121 "MessageTraceId": "4f74644747749djhrhfbf", "Index": 0} hi this is my raw data; how can i show it in a table in a nice format? index=mail , and please help RecipientDomain sender recipient subject Earliest Latest

sulaimancds · ‎03-12-2023

let me give you the raw log {"Organization": "groupxyz.onmicrosoft.com", "MessageId": "<12345678>", "Received": "2023-03-13T01:56:22.9207071", "SenderAddress": "bca@bca.com", "RecipientAddress": "dlf@g.com", "Subject": "12312312332231'", "Status": "Delivered", "ToIP": "111.1.11.1", "FromIP": "12.23.4.2.23232", "Size": 2022121 "MessageTraceId": "4f74644747749djhrhfbf", "Index": 0} in hi this is my raw data; how can i show it in a table in a nice format? index=o365, index=mail also has the same information , maybe we can use mail too RecipientDomain sender recipient subject Earliest Latest

sulaimancds · ‎03-12-2023

hi only those matching the policy will show for o365. i want to show all , and if hitsthe policy , it shoud show that it his the policy PII. Also there is an error running the command . currently it only show hit PII , i want to show the rest also , which does not hit any PII , if the recipient is free-domains like gmail, yahoo, outlook, then it should show the result as well Error in 'stats' command: The output field 'Recipient' cannot have the same name as a group-by field.

sulaimancds · ‎03-12-2023

there are Complete 115 events , but nothing is shown under statitcs.

sulaimancds · ‎03-12-2023

hi let me make it easier for you to understand , | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | lookup all_email_provider_domains domain AS RecipientDomain output domain as domain_match2 | where isnotnull(domain_match2) | stats values(recipient) as recipient values(subject) as subject earliest(_time) AS "Earliest" latest(_time) AS "Latest" by RecipientDomain sender | where mvcount(recipient)=1 | eval subject_count=mvcount(subject) | sort - subject_count | convert ctime("Latest") | convert ctime("Earliest") i need this requirments under O365 index , also the current one which matches the policy should show the results too

sulaimancds · ‎03-12-2023

there is error in the command Error in 'join' command: Invalid argument: 'sender=sender'

sulaimancds · ‎03-11-2023

Hi, Recipient domain is the match. In the lookup there is Gmail, in recipient email, it will shows the results. I need to use o365 logs only is that possible with the criteria.

sulaimancds · ‎03-11-2023

Hi o365 logs has all email captures. I've shown you the table above for PII result table. Please help.

sulaimancds · ‎03-10-2023

Hi, Just show me how to use o365 email logs and show all those hitting an the policy and those not hitting the policy, I will try to figure it out after that.

sulaimancds · ‎03-10-2023

Hi, Yes I want to use o365 only with some of the filter like subject count, 1 recipient only and lookup list However O365, only shows those matching the policy. If it does not match the policy, it does not show it to me. Please help for the new query.

Posts	84
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎02-23-2023

Online Status	Offline
Date Last Visited	‎08-23-2023 12:18 AM

iplocation query: How to show the country with thi...

How to create a search for lookup search two colum...

Help with Splunk search?

Address filter email

events not showing

Search to filter email?

How can I show o365 email logs in a table?

How to combine two searches into one?

How to write a Splunk audit search?

Search filter csv emails based off of another csv?

Address filter email

Re: events not showing

events not showing

Re: o365 email logs table query

Re: email filter query

Re: email filter query

Re: email filter query

Re: email filter query

Re: email filter query

Re: email filter query

Re: email filter query

Re: email filter query

Search to filter email?

Re: o365 email logs table query

Re: o365 email logs table query

How can I show o365 email logs in a table?

Re: How to combine two query into one?

Re: How to combine two query into one?

Re: How to combine two query into one?

Re: How to combine two query into one?

Re: How to combine two query into one?

Re: How to combine two query into one?

Re: How to combine two query into one?

Re: How to combine two query into one?

Re: How to combine two query into one?

Join the Conversation