Hello All,
Actually I want to create a report in which I can see that from how many different email domains I am getting the how many number of emails.
Like I have my company's email domain by the name of @indiapalace.com from where I am sending the emails and receiving the same.
So what I want is to know in RSA Security Analytics reporting is that from how many foreign or outside email domains I am getting the emails with their respective numbers of emails I received on the @indiapalace.com email domain.
This is all the what I want to see the details in my report.
Kindly suggest, if anyone have the idea for the same.
I am waiting for your response.
Thanks to everyone in advance.
One approach is to have a post-processing parser that extracts the domain (after the @) from the email.src/email.dst meta values and put it into new (or existing) meta keys (e.g. domain.src/domain.dst). See below for some prototypes of such parsers in lua.
And then use the latter meta keys for the reports.
Hope this helps!
/Hans
local DomainSrcFromEmailSrc = nw.createParser("DomainSrcFromEmailSrc", "This extracts the domain from the email.src")
---Version 1.1 updated on 2014-08-12
function DomainSrcFromEmailSrc:extractDomain(index, metaValue)
-- find the '@' in the email
local num_temp = string.find(metaValue, "@")
-- make sure that a '@' character was found
if num_temp ~= nil then
-- move to the position where the domain part starts
num_temp = num_temp + 1
-- read domain part (sub string up to the end of the line)
local string_temp = string.sub(metaValue, num_temp, string.len(metaValue))
-- make sure the read succeeded
if string_temp ~= nil then
-- register what was read as domain.src meta
nw.createMeta(self.keys["domain.src"], string_temp)
end
end
end
-- declare "meta keys"
DomainSrcFromEmailSrc:setKeys({
nwlanguagekey.create("domain.src"),
})
-- declare a meta-callback for when email.src meta is created
DomainSrcFromEmailSrc:setCallbacks({
[nwlanguagekey.create("email.src")] = DomainSrcFromEmailSrc.extractDomain,
})
local DomainDstFromEmailDst = nw.createParser("DomainDstFromEmailDst", "This extracts the domain from the email.dst")
---Version 1.1 updated on 2014-08-12
function DomainDstFromEmailDst:extractDomain(index, metaValue)
-- find the '@' in the email
local num_temp = string.find(metaValue, "@")
-- make sure that a '@' character was found
if num_temp ~= nil then
-- move to the position where the domain part starts
num_temp = num_temp + 1
-- read domain part (sub string up to the end of the line)
local string_temp = string.sub(metaValue, num_temp, string.len(metaValue))
-- make sure the read succeeded
if string_temp ~= nil then
-- register what was read as domain.dst meta
nw.createMeta(self.keys["domain.dst"], string_temp)
end
end
end
-- declare "meta keys"
DomainDstFromEmailDst:setKeys({
nwlanguagekey.create("domain.dst"),
})
-- declare a meta-callback for when email.dst meta is created
DomainDstFromEmailDst:setCallbacks({
[nwlanguagekey.create("email.dst")] = DomainDstFromEmailDst.extractDomain,
})