2
SMTP Alerting question
Question asked by Matthew Titley - 2/19/2019 at 8:31 AM
Answered
Hi all,

Had an account get compromised today. I have alerting set up so that when "Billy" sends an email to more than 50 recipients, the system generates an alert. I've found that this isn't a very useful alert in practice. However, when "Bobby" has 3,000 messages in the outbound queue all going to one unique recipient per message, I don't see an alerting threshold category for that. Is there one that I'm simply missing?

Thanks,

Matt

2 Replies

Reply to Thread
0
Employee Replied
Employee Post Marked As Answer
Hi Matt, 

What's the system event that you currently have set up? 

I'm not aware of an event notification that could be used to alert you when "Billy" sends an email to more than 50 recipientsThe domain has a 'Recipients per Message' limit that will block webmail messages from being sent if they exceed the domain's threshold. For example, if the limit is set to 30, and a user tries to send an email to 50 recipients, the message would be blocked from being sent. (At this time, this limit looks to only be enforced via webmail, but we're considering how this limit could be enforced via clients as well.)

You can, however, configure a system event to notify you when a user has been throttled for exceeding their outgoing messages per hour limit. You would set up the event with Event Category: Throttling and Event Type: User Throttled. In order for this to be triggered, you would need to verify that your users have a throttling action enabled on their accounts. (You can propagate a throttling limit and a Delay or Reject action for all users using the User Defaults template. Then customize that threshold / action per user, as needed.) This throttling event would be useful for when a user "has 3,000 messages in the outbound queue all going to one unique recipient per message". Once the user hits the throttling threshold, the throttling action would be taken, and an email would be fired off to the address specified in the event.
1
Matthew Titley Replied
Thanks, Andrea. I'll do that. Really appreciate it!

Reply to Thread