Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Evren_Buyer
Contributor

How to get e-mail forensic data using the query syntax?

Hi Everyone !

I'm new to Threat Emulation (TE) and just located my GW as next hop MTA and started to use TE in the middle of my mail system as best practices overview.

Internet-->SMTP Security GW ---> CP MTA (Threat Emulation,Threat Extracion, Anti-Spam, E-Mail Security BLADES ON)---> Exchange Server ---> E-Mail Client

My question is to get forensic data those mails pass through the CP Threat Prevention system.

When I made a query in the log according to the sender address like below is available to be filtered, but when I try to make a query according to receipent I'm getting thousands of internal user data, cause my AD name the as my e-mail address...

I researched the query methods and in the query pane "other filelds" I found out "email_address:" and tried to make a query with that but no success !!! Nothing came out....

For e-mail forensic like blocked and extracted e-mails I need to make queries according to e-mail receipent, e-mail sender, e-mail subject, all of them etc... Does anyone know how to do that? I also have Smart Event license and server...

6 Replies
PhoneBoy
Admin
Admin

This is really more of a Logging, Monitoring, & Event Analysis‌ question.

Kfir Dadosh‌ any ideas?

0 Kudos
RickLin
Advisor
Advisor

Can CheckPoint tell us what kind of blade logs or what kind of field data are not be indexed by Solr ?

Kfir_Dadosh
Collaborator

the "to" (Recipient) field is index only in SmartEvent, and not in SmartLog.

You can create a view in SmartEvent that show a table with list of recipients and some other relevant data.

Drill down on this table will get you to the logs of that selected recipient.

Alternatively, you can search only for the email, and filter for the blade Threat Emulation.

Evren_Buyer
Contributor

Hi Kfir Dadosh,

Thanks for the helpful answer. As an IT Manager, who's full control on FW, momentary searches are so important to me. I call myself one of the oldest CP user, inTurkey as I first met CP in 2000 (Turk Nokta Net, ISP) as network specialist, since so on...

I know CP is not invented for e-mail security but after "blades" future where it became... So if it's also an e-mail security, as a customer, I'm wishing to search more e-mail related criteria in SmartLog

Thanks all you guys Kfir Dadosh‌ and Dameon Welch Abernathy‌ for your time and interest.

Reagards,

0 Kudos
Thomas_Werner
Employee Alumnus
Employee Alumnus

Hi Evren,

what kind of logs do you get in addition when you query the recipient ?

To only get TE logs for a certain recipient you can also add more filters:

blade:"Threat Emulation" AND "SMTP Emulation" AND "linda@acme.com"

Regards Thomas

Evren_Buyer
Contributor

Hi Thomas,

Adding blade filters like blade:"Threat Emulation" AND "smtp emulation" AND "*@mydomain.com" did the magic. I was wondering about the e-mail addresses ending with mydomain.com were also identity awarness usernames. So I was messed up with it...

THANKS A LOT...

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events