Jump to content

Exporting attachments in emails for particular extension names


Recommended Posts

Hi Glenn,

 

I am sure there is more than one way to do this. Here is 2 rough process that should get you most of the way there... 

 

 

1. Use the Location facet to load all sources

2. Use the Type facet to Include Email messages

3. Open the Column Chooser, Select, "Attachments" and "Type" 

4. In the results view sort by "Attachments" 

5. Highlight the items that have attachments of interest and tag. 

6. Export items in that tag. 

7. Optional based on need - Use  Parent options to export only Top-Level parents. 

 

 

A. Create a Keyword list with the extensions you are looking for

 

*.exe

*.scr

*.msi

*.html

*.htm

*.XXX

 

B. Run the Keyword List 

C. Use the Type facet to load all emails

D. Review the overlap Cluster between the KW list and the email Clusters using the "Attachments" Column..

E. Tag and export.

F. Save results as a saved search for reuse. 

 

You will need to do some tweaking of these approaches to get it right. It will also require some visual review to select the attachment types of interest. 

 

Hope this helps. 

 

 

 

 

Link to comment
Share on other sites

Hi Glenn,

 

Extracting embedded URL's to a CSV. This will need some work between Intella and Excel or Notepad ++ type tool. 

 

1. Export > Words > All Words in case

2. Open in Excel > Filter on the Text Field > select all and copy to new table 

3. Search for @ select all and clear contents > This will get rid of email addresses... 

4. Search for www select all and copy to new table

5. Search for .com  select all and copy to new table - sure you could do a .net, .org, .co.uk all that the same time... 

6. .........

 

This process does need some work to perfect.  You could probably write a small perl script or Notepad ++ macro to do this for you...

 

If you do please share the results here so others can benefit along with you.. 

Link to comment
Share on other sites

  • 5 years later...

Hello,

I too have found this procedure to be very helpful, but I have run into some issues with Excel locking up due to the amount of data. I am working with a large volume of emails >20,000, looking for possible phishing attempts. Has anyone had any success extracting URL's from emails using any other method? I am using Intella Viewer 2.2.1.

Thank you,

Josh

Link to comment
Share on other sites

Excel should not be abused for text processing 😄

AFAIR, Notepad++ supports PCRE, so it should be possible to filter URLs. For example of a full URI PCRE see https://stackoverflow.com/questions/161738/what-is-the-best-regular-expression-to-check-if-a-string-is-a-valid-url/190405#190405

You should also be able to run Content Analysis facet with some regex for URLs, then export values. Hopefully the facet will some day support full PCRE.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
 Share

×
×
  • Create New...