I have been tasked with increasing the logging coming from our Exchange servers. One of the requests is to include logging of email attachment content, size, name, or anything else I can collect. I have read the blog post on this found here: http://blogs.splunk.com/2013/12/02/detecting-attachments-in-microsoft-exchange-server-2013/
But I was wondering if there are any alternative ways to doing this, or if anyone had specific instructions on how to get this done (I would like to limit the time our exchange guys need to work on this)
I think that this must be configured in exchange.
if the attachment is not being logged, there is no way for Splunk to alert on it.
however, there are other technologies that might be in your possession that can get that data. Cisco ESA (Ironport) and i believe that plenty other tools as well. in most of those tools, you will have ot enable that collection as well.
here is a short version of how to do so in ESA:
hope it helps