name: Monitor Email For Brand Abuse
id: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8
version: 2
date: '2018-01-05'
author: David Dorsey, Splunk
type: batch
datamodel:
- Email
description: This search looks for emails claiming to be sent from a domain similar
  to one that you want to have monitored for abuse.
search: '| tstats `security_content_summariesonly` values(All_Email.recipient) as
  recipients, min(_time) as firstTime, max(_time) as lastTime from datamodel=Email
  by All_Email.src_user, All_Email.message_id | `drop_dm_object_name("All_Email")`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval
  temp=split(src_user, "@") | eval email_domain=mvindex(temp, 1) | lookup update=true
  brandMonitoring_lookup domain as email_domain OUTPUT domain_abuse | search domain_abuse=true
  | table message_id, src_user, email_domain, recipients, firstTime, lastTime | `monitor_email_for_brand_abuse_filter`'
how_to_implement: You need to ingest email header data. Specifically the sender's
  address (src_user) must be populated.  You also need to have run the search "ESCU
  - DNSTwist Domain Names", which creates the permutations of the domain that will
  be checked for.
known_false_positives: None at this time
references: []
tags:
  analytic_story:
  - Brand Monitoring
  - Suspicious Emails
  asset_type: Endpoint
  cis20:
  - CIS 7
  kill_chain_phases:
  - Delivery
  nist:
  - PR.IP
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - All_Email.recipient
  - All_Email.src_user
  - All_Email.message_id
  security_domain: network
