Email dashboard
The Emaildashboard displays an overview of data relevant to the email infrastructure being monitored. The dashboard searches displays result based on the time period selected using the dashboard time picker.
Dashboard filters
The Emaildashboard filters assists in searching email protocol data, refined by the search filters. The dashboard is used in ad-hoc searching of email protocol data, but is also the primary destination for drilldown searches used in the email activity dashboard panels.
The Email search page displays no results unless it is opened in response to a drilldown action, or you set a filter or time range and select Submit.
| Filter by | Description |
|---|---|
| Destination | Destination IP address. |
| Source | Source IP address. |
| Email protocol | The email communication protocol. |
| Recipient | The recipient's email address. |
| Sender | The sender's email address. |
| User | The identity of the individual or account responsible for sending, receiving, or generating the email traffic being logged. |
| Business unit | The organizational group, department, or division classification assigned to an asset or a user identity. |
| Watchlisted users | A specific person or account flagged by your security team for closer monitoring due to a higher risk of insider threats, data exfiltration, or policy violations. |
Key indicators
Displays the metrics relevant to the dashboard sources over the past 48 hours. Key indicators represent summary information and appear at the top of the dashboard. See Key indicators in Splunk Enterprise Security.
| Key indicator | Description |
|---|---|
| Non corporate email volume | Measures the total amount of emails sent by internal users to external, unapproved, or personal email domains that do not belong to your company. |
Dashboard panels
| Panel | Description |
|---|---|
| Email search | Used for ad-hoc investigations and drilldown analysis of email protocol data. |
| Email events | Tracks the individual log entries representing network-level or protocol-level email transactions processed by your organization's mail servers or monitored network segments. |
| Non corporate email activity | Displays a list of users performing high-volume or large-size email transactions directed to external, non-corporate email domains. |
Data sources
The reports in the Email activity dashboard use fields in the email data model. Relevant data sources include all the devices or users generating email protocol traffic on the network captured from vulnerability scanners and packet analysis tools such as Splunk Stream and the Bro network security monitor.