mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
22 lines
666 B
YAML
22 lines
666 B
YAML
author: David Dorsey, Splunk
|
|
date: '2017-11-09'
|
|
description: This search returns all the emails from a specific sender over the last
|
|
24 and next hours.
|
|
how_to_implement: To successfully implement this search you must ingest your email
|
|
logs or capture unencrypted email communications within network traffic, and populate
|
|
the Email data model.
|
|
id: 5df39b3f-447d-4869-b673-8f45ad4616fe
|
|
inputs:
|
|
- src_user
|
|
name: Get Emails From Specific Sender
|
|
search: '| from datamodel Email.All_Email | search src_user=$src_user$'
|
|
tags:
|
|
analytic_story:
|
|
- Brand Monitoring
|
|
- Suspicious Emails
|
|
- Web Fraud Detection
|
|
product:
|
|
- Splunk Phantom
|
|
type: response
|
|
version: 1
|