How to get e-mail forensic data using the query syntax?

[Evren_Buyer]

Hi Everyone !

I'm new to Threat Emulation (TE) and just located my GW as next hop MTA and started to use TE in the middle of my mail system as best practices overview.

Internet-->SMTP Security GW ---> CP MTA (Threat Emulation,Threat Extracion, Anti-Spam, E-Mail Security BLADES ON)---> Exchange Server ---> E-Mail Client

My question is to get forensic data those mails pass through the CP Threat Prevention system.

When I made a query in the log according to the sender address like below is available to be filtered, but when I try to make a query according to receipent I'm getting thousands of internal user data, cause my AD name the as my e-mail address...

I researched the query methods and in the query pane "other filelds" I found out "email_address:" and tried to make a query with that but no success !!! Nothing came out....

For e-mail forensic like blocked and extracted e-mails I need to make queries according to e-mail receipent, e-mail sender, e-mail subject, all of them etc... Does anyone know how to do that? I also have Smart Event license and server...

[PhoneBoy]

This is really more of a Logging, Monitoring, & Event Analysis‌ question.

Kfir Dadosh‌ any ideas?

[RickLin]

Can CheckPoint tell us what kind of blade logs or what kind of field data are not be indexed by Solr ?

[Kfir_Dadosh]

the "to" (Recipient) field is index only in SmartEvent, and not in SmartLog.

You can create a view in SmartEvent that show a table with list of recipients and some other relevant data.

Drill down on this table will get you to the logs of that selected recipient.

Alternatively, you can search only for the email, and filter for the blade Threat Emulation.

[Evren_Buyer]

Hi Kfir Dadosh,

Thanks for the helpful answer. As an IT Manager, who's full control on FW, momentary searches are so important to me. I call myself one of the oldest CP user, inTurkey as I first met CP in 2000 (Turk Nokta Net, ISP) as network specialist, since so on...

I know CP is not invented for e-mail security but after "blades" future where it became... So if it's also an e-mail security, as a customer, I'm wishing to search more e-mail related criteria in SmartLog

Thanks all you guys Kfir Dadosh‌ and Dameon Welch Abernathy‌ for your time and interest.

Reagards,

[Thomas_Werner]

Hi Evren,

what kind of logs do you get in addition when you query the recipient ?

To only get TE logs for a certain recipient you can also add more filters:

blade:"Threat Emulation" AND "SMTP Emulation" AND "linda@acme.com"

Regards Thomas

[Evren_Buyer]

Hi Thomas,

Adding blade filters like blade:"Threat Emulation" AND "smtp emulation" AND "*@mydomain.com" did the magic. I was wondering about the e-mail addresses ending with mydomain.com were also identity awarness usernames. So I was messed up with it...

THANKS A LOT...