topic Re: how to monitor web activity using domain name. in General Topics

how to monitor web activity using domain name.

AzerbaijanSupermarkets — Fri, 13 Jul 2018 08:04:05 GMT

Good day to everyone!

I have such a case: I have to find out which users send email to ecober.com.

I have researched, but couldn't find any useful information.

Which filters should I use in monitor tab?

Thanks in advance!

Re: how to monitor web activity using domain name.

reaper — Fri, 13 Jul 2018 13:53:12 GMT

you can reach out to your local sales team and have them add your vote to Feature Request FR 1255

Re: how to monitor web activity using domain name.

BPry — Fri, 13 Jul 2018 14:21:37 GMT

@AzerbaijanSupermarkets,

Generally one would look up the MX records for ecober.com (currently 173.203.187.1 and 173.203.187.2) and then you could utilize that within your search. The issue that you'll run into however is that the user is likely going through a relay server and won't actually show as 'source-user x connected to 173.203.187.1' from the firewall. This is where logging on your email server or email gateway will have to be reviewed and you'll have to see which users actually sent emails to 'ecober.com' or the addresses recorded in their MX record.

Hopefully that helps.

Re: how to monitor web activity using domain name.

JoeAndreini — Fri, 13 Jul 2018 14:37:01 GMT

Would it be possible to identify the recipient domain in a custom app by matching smtp-req-argument?

Then simply report on that application

Re: how to monitor web activity using domain name.

Remo — Sun, 15 Jul 2018 16:48:23 GMT

@AzerbaijanSupermarkets

As mentionned by @BPry, in my eyes this is a job for an email relay/gateway server, not really for a firewall.

(Except maybe if FR 1255 sometimes will be implemented? @reaper: what exactly is this FR about? Logging of sender and receipient in smtp connections?)

Re: how to monitor web activity using domain name.

AzerbaijanSupermarkets — Mon, 16 Jul 2018 06:14:02 GMT

Thank you all for your replies.

Yes, we made this report using our local mail server.

But, we can't filter other mail applications (like gmail, yahoo and etc.).

This is still an issue.

Re: how to monitor web activity using domain name.

reaper — Mon, 16 Jul 2018 10:47:34 GMT

@Remo wrote:

(Except maybe if FR 1255 sometimes will be implemented? @reaper: what exactly is this FR about? Logging of sender and receipient in smtp connections?)

FR1255 requests to add sender and receiver email address in the threat logs