×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Newton
Engager
Member since: ‎12-15-2020
‎04-10-2021
Community Statistics
Posts 3
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎12-15-2020
View All

Re: how to monitor and alert Auto-forwarding rule ...

by in Splunk Search
‎12-15-2020 10:13 PM
‎12-15-2020 10:13 PM
so far i have built till this query through which i get to look at the logs with a better view, but i could not figure out a way to create exception for approved domains, and also could not extract the right field as there are mutilple fields with the same name "value""  Workload=Exchange (Operation=New-InboxRule OR Operation=Set-Mailbox OR Operation=UpdateInboxRules OR Operation=Set-InboxRule OR Operation=Disable-InboxRule OR Operation=Enable-InboxRule) (Parameters{}.Name=ForwardingSmtpAddress OR Parameters{}.Name=DeliverToMailboxAndForward OR Parameters{}.Name=RedirectT0 OR Parameters{}.Name= ForwardAsAttachmentTo OR Parameters{}.Name=ForwardTo) Parameters{}.Value!=”” | fields CreationTime ClientIP Operation UserId Parameters{}.Name Parameters{}.Value | table CreationTime ClientIP Operation UserId Parameters{}.Name Parameters{}.Value | sort -CreationTime | rename ClientIP AS src_ip, CreationTime AS event_time, ObjectID AS Account_Name, “Parameters{}.Value” AS value, “Parameters{}.Name” AS value_name ... View more

how to monitor and alert Auto-forwarding rule usin...

by in Splunk Search
‎12-15-2020 10:03 PM
‎12-15-2020 10:03 PM
Hi all, Need help to build a query which helps   to identify the users that possibly leaking /auto-forwarding emails to his personal email address (e.g. gmail) based on Exchange logs and also need to add exceptions when some forwarding are approved Sample exchange log 1 : {"AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "", "ClientIP": "98.98.98.98:65426", "CreationTime": "2020-12-11T14:44:23", "ExternalAccess": false, "Id": "720fba63-b1bf-4578-1eab-08d89de34066", "ObjectId": "123456\\1234567890", "Operation": "Set-InboxRule", "OrganizationId": "master", "OrganizationName": "abc.com", "OriginatingServer": "ABCDEFGHIJ (15.20.3632.023)", "Parameters": [{"Name": "AlwaysDeleteOutlookRulesBlob", "Value": "False"}, {"Name": "Force", "Value": "False"}, {"Name": "Identity", "Value": "Test"}, {"Name": "ForwardTo", "Value": "david@123.com;sam@abc.com"}, {"Name": "From", "Value": "sam@abc.com"}, {"Name": "Name", "Value": "Test"}, {"Name": "SubjectContainsWords", "Value": "TEST23"}, {"Name": "StopProcessingRules", "Value": "True"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "84579310-05ab-4d3f-bd58-c8ebbe43da2f", "UserId": "chris@abc.net", "UserKey": "1003200077814EEE", "UserType": 2, "Version": 1, "Workload": "Exchange"} Company domain : abc.com ; auto forward rules configured to send emails to "david@123.com" is suspicious and that has to be alerted. ( Any domains other than abc.com and abc.net are considered as external and has to be alerted) ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎04-10-2021 11:03 AM
Karma given to
View All