Reporting

Prevent Splunk alerts from going to quarantine on O365 Exchange Online

dkr3500
Path Finder

All of my Splunk alerts and reports are getting quarantined by Microsoft's spam filter, the reason being: "Quarantine reason:
Phish". The alerts are simply sent from "splunk" with no email address associated with it, so I can't even add it to "Safe Senders/Recipients".

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can change your Splunk email settings to have alerts and reports come from an email address.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can change your Splunk email settings to have alerts and reports come from an email address.

---
If this reply helps you, Karma would be appreciated.

dkr3500
Path Finder

Yes, that did work. On the SH, I went to Settings > Server settings > Email settings > edited the Send emails as field to a proper email address.

As an FYI, you may have to edit savedsearches.conf, specifically the line: "action.email.from = "

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...