We use exchange 2013 and relay permission is given to certain machines(IP's). These machines can send email as any existing or non existent user under our domain. but they are only allowed to send email from a particular email address. So far I have achieved the following created an alert if a machine sends an email from another email address which is not allowed or approved. but this works only for a search like   index="myindex" OriginalClientIp="10.x.x.x" NOT Sender="non-existent_user@domain.com" | table Sender Recipients Timestamp OriginalClientIp   I have a list of email addresses and IP's.  There will be a max of two email addresses from each IP any way to lookup a table and list out non matching "from email addresses"? ... View more

Hi I am trying to explore more ways to check if business email compromise is being happening in our organization, just before the end user recognises it. i have a list of domains that we usually communicate with,  there are around 490 domains I have listed and added to a csv file.  there is an index which is updated in realtime which have logs from mimecast. I would like to list out domains which are trying to establish email communication with our organization which are not there in the csv file. so if a non matching domain is emailing us, it should display in a dashboard. is this possible? ... View more