Hi Team,
I have used the below search to find the top senders
eventtype=cisco-esa | transaction keepevicted=true icid mid | search host="*" sender="*" recipient="*" dest_interface="*" policy_direction="*" threat_reason="*" | stats count by sender,recipient,threat_reason,host,sender_reputation,policy_direction,_time | top sender
But I need to create an alert if any sender has sent emails more than 25 per hour
If you want an alert when something happens, then you need to search for that something.
eventtype=cisco-esa earliest=-60m
| transaction keepevicted=true icid mid
| search host="*" sender="*" recipient="*" dest_interface="*" policy_direction="*" threat_reason="*"
| stats count, values(recipient) as recipients, values(threat_reason) as threat_reasons, values(host) as hosts, values(sender_reputation) as sender_reputation, values(policy_direction) as policy_direction, values(_time) as _time by sender
| where count>100
Hi richgalloway,
I wanted to get the count of senders to multiple users; in the above query we get only the count of senders per recipient.
The above answer displays "any sender has sent emails more than 25 per hour". To get sender/recipient pairs, try this:
eventtype=cisco-esa earliest=-60m
| transaction keepevicted=true icid mid
| search host="*" sender="*" recipient="*" dest_interface="*" policy_direction="*" threat_reason="*"
| stats count, values(threat_reason) as threat_reasons, values(host) as hosts, values(sender_reputation) as sender_reputation, values(policy_direction) as policy_direction, values(_time) as _time by sender,recipient
| where count>100