I tried creating an ES App alert to detect if anyone is sending emails to the mentioned blacklisted domains, but its showing me an error
| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where 'recept'=(@gproxy10-pub.mail.unifiedlayer.com or @gmail.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)
Error I am getting
Error in 'where' command: The expression is malformed. An unexpected character is reached at '@gproxy10-pub.mail.unifiedlayer.com or @gmail.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)'.
Hi,
Try somthing like this:
| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com" OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")
Error in 'where' command: The expression is malformed. Expected ).
| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com") OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")
query did work, but not giving the correct data, it is giving all the sources, however I only need the mentioned ones
Can you share some sample recipient data ?