How does ES know local customer domain names so it can detect internal vs. external emails?
How does ES know local customer domain names so it can detect internal vs. external emails?
ES (Enterprise Security) can determine local customer domain names by editing the Corporate Web and Email Domain Lookups during initial configuration. This enables the system to differentiate between internal and external emails.
D is the correct answer
D is correct. Page 140 "Administering Splunk ES 7.1" Edit any of the Domain lookups: – Corporate Web Domains – Corporate Email Domains – Cloud Domains (external vendor sites)