How to Handle High-Volume Email Events in XSOAR Without Overloading the System

[A.MuharramIshaq]

Hello guys,

I am currently working on Use Case for my organization to handle email threats that bypass our Trend Micro Email Security (TMS) gateway.

Context

• My organization uses Trend Micro Email Security as the email gateway.

• Some phishing, spam, and malware emails still bypass TMS filtering and reach user inboxes.

• These emails are logged in Splunk from TMS.

• We want to integrate Splunk → XSOAR → TMS so that:

  1. Emails that bypass TMS are analyzed in XSOAR.

  2. XSOAR classifies them as phishing, spam, or malware.

  3. Based on the classification, XSOAR sends an action back to TMS via API (block sender/domain or quarantine email).

---

The Challenge

The email volume is extremely high. In one hour, there can be over 100,000 events from TMS logs.

As XSOAR is incident-driven, each fetched event will be created as an incident before the playbook runs.
If we let all these events become incidents, the system will consume a huge amount of resources, which is not efficient since our main goal is only to identify and take action on malicious/spam emails.

We want to know:

• Is there a way to pre-filter or batch process these events before they are turned into incidents?

• Can XSOAR fetch from Splunk (or API) using query filters to reduce the number of incidents created?

• Is there a recommended best practice for handling high-volume events like this in XSOAR?

---

Expected Outcome

• Reduce incoming email events so that XSOAR only processes those with a high probability spam.

• Possibly group multiple events into a single incident for batch processing.

• Still be able to send final actions (block/quarantine) back to TMS after classification.

Any guidance, suggestions, or reference playbooks from the community would be highly appreciated.

Thanks in advance!