Email Traffic Use Cases
Grouped by Detection Method
Aggregate Count
- Count of Outbound Emails per Source User/System
- Count of Inbound Emails per Source User/System
- Count of Outbound Emails per Destination User
- Count of Inbound Emails per Destination User
- Count of Unique Destination Users per Source User/System
Blacklist Alert
- Known-Bad SMTP User Agent
- Inbound Emails Using Internal Email Address as Source or Reply-to
- Email Attachments with Cosecutive Spaces or Extensions (e.g. .docx.exe)
- Outbound Email to Known-Bad Addresses
Whitelist Alert
Levenshtein Score Alert
- Typosquatting Company Domains
Rolling Whitelist Alert
- Newly Observed SMTP User Agent
- Newly Observed Destination Email Domain
- Newly Observed Source Email Domain
Shannon Entropy Score Alert
- High Entropy Domain Name Observed
Threshold Alert
- Source User, Direction=Outbound where Source User Count exceeds threshold
- Source System, Direction=Outbound where Source System Count exceeds threshold
- Source User, Direction=Inbound where Source User Count exceeds threshold
- Source System, Direction=Inbound where Source System Count exceeds threshold
- Destination SMTP Server, Direction=Outbound where Destination SMTP Server Count exceeds threshold
- Subject=Non-Delivery Report where Count exceeds threshold
Log Source Examples
- Email server logs
- Email secure gateway logs
- Endpoint Email client logs
Possible False Positives