Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- About ccuadra
ccuadra
New Member
Member since:
01-12-2018
06-05-2020
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 01-12-2018 |
Activity Feed
- Posted Re: Help with Antispam alert on Alerting. 01-12-2018 02:16 PM
- Posted Re: Help with Antispam alert on Alerting. 01-12-2018 01:59 PM
- Posted Re: Help with Antispam alert on Alerting. 01-12-2018 01:43 PM
- Posted Re: Help with Antispam alert on Alerting. 01-12-2018 01:26 PM
- Posted Re: Help with Antispam alert on Alerting. 01-12-2018 01:24 PM
- Posted Re: Help with Antispam alert on Alerting. 01-12-2018 01:06 PM
- Posted Re: Help with Antispam alert on Alerting. 01-12-2018 12:56 PM
- Posted Help with Antispam alert on Alerting. 01-12-2018 08:45 AM
- Tagged Help with Antispam alert on Alerting. 01-12-2018 08:45 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
01-12-2018
02:16 PM
That was my problem, now its working like a charm!!! You are a genius.
... View more
01-12-2018
01:43 PM
Ok, I changed my search as you suggested and sent 5 emails (the rule was changed to >=4) but the alert was not triggered according to splunk. However, if I open the alert search, it founds my test.
... View more
01-12-2018
01:26 PM
Is worth mentioning that for test purposes, I changed the rule to report >= 5 emails, I sent 5 emails to different email addresses with the same subject, but the alert did not trigger, not sure what is happening.
... View more
01-12-2018
01:24 PM
I tested your search, however, is not showing the results as I need to see it. Usually the spams send the same subject to many users, "Account information" for instance, so I need it to send me an email if someone sends more than 10 emails with the same subject (which I could verify if is a spam).
... View more
01-12-2018
01:06 PM
This will be one example:
2018:01:12-13:13:38 smtp_gateway smtpd[3024]: SCANNER[3024]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="xxx.xxx.xxx.xxx" from="[email protected]" to="[email protected]" subject="AN EMAIL" queueid="1ea4lm-0000mm-Gp" size="6000"
... View more
01-12-2018
12:56 PM
2018:01:12-13:13:38 smtp_gateway smtpd[3024]: SCANNER[3024]: id="1000" severity="info" sys="SecureMail" sub="smtp" name="email passed" srcip="xxx.xxx.xxx.xxx" from="[email protected]" to="[email protected]" subject="AN EMAIL" queueid="1ea4lm-0000mm-Gp" size="6000"
... View more
01-12-2018
08:45 AM
Good day team,
I am trying to create an alert for anti-spam, it is supposed to send an email to me if someone sends more than 10 emails in 5 minutes. However, I cannot make it work for some reason. Could you please help me with this?
This is the search I am using:
host="10.10.10.10" "email passed" NOT from="" NOT [email protected] | stats count by from name subject |where count >= 10
These are the alert settings:
Settings
Alert name: SPAM
Alert Type: Real-time
Trigger condition
Trigger alert when: Per-Result
Trigger actions
When triggered: Send email
Best regards.
... View more
- Tags:
- splunk-enterprise
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
