Getting Data In

How to detect email attachment content, size, name, etc from Microsoft Exchange server logs?

JScordo
Path Finder

I have been tasked with increasing the logging coming from our Exchange servers. One of the requests is to include logging of email attachment content, size, name, or anything else I can collect. I have read the blog post on this found here: http://blogs.splunk.com/2013/12/02/detecting-attachments-in-microsoft-exchange-server-2013/

But I was wondering if there are any alternative ways to doing this, or if anyone had specific instructions on how to get this done (I would like to limit the time our exchange guys need to work on this)

Thank you

0 Karma

adonio
Ultra Champion

I think that this must be configured in exchange.
if the attachment is not being logged, there is no way for Splunk to alert on it.
however, there are other technologies that might be in your possession that can get that data. Cisco ESA (Ironport) and i believe that plenty other tools as well. in most of those tools, you will have ot enable that collection as well.
here is a short version of how to do so in ESA:
http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118808-technote-esa-00.h...
https://supportforums.cisco.com/discussion/12311151/attachment-name-na-message-tracking
hope it helps

0 Karma

sheamus69
Communicator

Did you resolve this issue? I'm facing a similar activity at the moment...

0 Karma

JScordo
Path Finder

Not yet, our team updated from exchange 2010 to o365 so now I have a whole new bag of issues.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...