author: David Dorsey, Splunk
date: '2017-11-09'
description: This search returns all the emails from a specific sender over the last
  24 and next hours.
how_to_implement: To successfully implement this search you must ingest your email
  logs or capture unencrypted email communications within network traffic, and populate
  the Email data model.
id: 5df39b3f-447d-4869-b673-8f45ad4616fe
inputs:
- src_user
name: Get Emails From Specific Sender
search: '| from datamodel Email.All_Email | search src_user=$src_user$'
tags:
  analytic_story:
  - Brand Monitoring
  - Suspicious Emails
  - Web Fraud Detection
  product:
  - Splunk Phantom
type: response
version: 1
