Cyber Security: Email
Description
The Email section monitors email traffic, spam campaigns, violations of corporate email usage policies, and phishing attempts.
Displayed Data
- number of unique delivered, quarantined, and blocked messages
- statistics on message delivery statuses
- trends in message delivery statuses
- trends in message volume
- senders and recipients with the highest message volume or count
- event statistics broken down by sender
- event statistics broken down by recipient
List of Dashboards
The section includes three dashboards.
Email: Overview
Email: Sender Profile
Email: Recipient Profile
Data Model
The section uses the following fields from data sources. Alias used: sm_cs_email_indexes.
Categorization Fields
| Field Name | Value |
|---|---|
event.kind | event |
event.category | |
event.type | allowed | denied | info |
event.action | deliver | quarantined | rejected |
General Purpose Fields
Email Message Parameters email
| Field Name | Value |
|---|---|
email.from.address | Sender's email address. |
email.to.address | Recipient's email address. |
email.subject | Message subject. |
email.direction | inbound | outbound | unknown |
email.message_id | Email message identifier. |
Other Fields
| Field Name | Value |
|---|---|
event.original | Original event text. |
network.bytes | Message size. |
Reference Tables
Below is a table of reference tables used in the section.
| Name | Fields | Description |
|---|---|---|
sm_cs_email_group_lookup | email.addressemail_group.name | Reference table for email address groups. |