# Correlation Query for spam email - not working

**URL:** <https://discuss.elastic.co/t/correlation-query-for-spam-email-not-working/354175>\
**Category:** SIEM\
**Created:** [February 27, 2024, 4:55am UTC](https://discuss.elastic.co/t/correlation-query-for-spam-email-not-working/354175 "2024-02-27T04:55:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hamidijaz](https://avatars.discourse-cdn.com/v4/letter/h/ecd19e/32.png) [@hamidijaz](https://discuss.elastic.co/u/hamidijaz)\
**Post date:** [February 27, 2024, 4:55am UTC](https://discuss.elastic.co/t/correlation-query-for-spam-email-not-working/354175/1 "2024-02-27T04:55:55Z")

</div>

Hi,

I have created a correlation rule with the following query, that runs every 5 mins. This is to detect if any external email address sends multiple emails to our internal email within given time (an hour), then it should trigger an alert. Please tell me what is the issue with it.

"  
sequence by email.from.address, email.to.address with maxspan=60m  
[any where email.direction == "inbound"] with runs=2  
"

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2024, 4:56am UTC](https://discuss.elastic.co/t/correlation-query-for-spam-email-not-working/354175/2 "2024-03-26T04:56:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.