mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
divious1
20 lines
635 B
YAML
20 lines
635 B
YAML
author: Bhavin Patel, Splunk
|
|
date: '2017-11-09'
|
|
description: This search returns all the information Splunk might have collected a
|
|
specific email message over the last 2 hours.
|
|
how_to_implement: To successfully implement this search you must be ingesting your
|
|
email logs or capturing unencrypted network traffic which contains email communications.
|
|
id: bc91a8cf-35e7-4bb2-8140-e756cc06fd75
|
|
inputs:
|
|
- message_id
|
|
name: Get Email Info
|
|
search: '| from datamodel Email.All_Email | search message_id=$message_id$'
|
|
tags:
|
|
analytic_story:
|
|
- Brand Monitoring
|
|
- Suspicious Emails
|
|
product:
|
|
- Splunk Phantom
|
|
type: response
|
|
version: 1
|