https://live.paloaltonetworks.com/t5/custom-signatures/wildfire/m-p/599794#M520 <P>Hello Team,</P> <P>&nbsp;</P> <P>We have an alert in our Splunk for Palo Alto Wildfire with threat name as "Email Link". However checking, see both user and recipients are same for the alert log and don't see any such subjected email in our Email Gateway (Proofpoint). What does it means when I don't see any internal recipient but smtp logs are recorded within our SIEM Tool logs ? (I did check over Url and that seems to be a Phish)</P> Tue, 08 Oct 2024 15:17:01 GMT naveen.tikkisetty 2024-10-08T15:17:01Z https://live.paloaltonetworks.com/t5/custom-signatures/wildfire/m-p/599794#M520 <P>Hello Team,</P> <P>&nbsp;</P> <P>We have an alert in our Splunk for Palo Alto Wildfire with threat name as "Email Link". However checking, see both user and recipients are same for the alert log and don't see any such subjected email in our Email Gateway (Proofpoint). What does it means when I don't see any internal recipient but smtp logs are recorded within our SIEM Tool logs ? (I did check over Url and that seems to be a Phish)</P> Tue, 08 Oct 2024 15:17:01 GMT https://live.paloaltonetworks.com/t5/custom-signatures/wildfire/m-p/599794#M520 naveen.tikkisetty 2024-10-08T15:17:01Z