Most efficient method to mass delete spam/phishing emails from users inboxes

[Noah Barker]

Hello, 

Just asking a general theory question since I feel like there is a much better way to accomplish my current task. How do you all remove spam or phishing emails that happen to slip past your rules and filters?  

  

Right now I use a GAM-ADV command like this that I tweak on a case by case basis:

gam ou_and_children /Users delete messages query "subject:[SUBJECT]" doit

That generally works fine when spam makes it through to a handful of users or to a specific email group but if we have an email sent to our entire domain, it can take hours to get through our domain 1 by 1. Should I be reworking my command to find the recipients of the original email and piping that into the delete command or should I be doing something else altogether? 

Thanks,

[Elijah Gladwell]

Hi All,

Just a follow-up question to this;

Is there a way we can export to csv who received the email and, more importantly, who opened it before deleting? 

Thank you!

[Ross Scroggs]

Elijah,

gam config auto_batch_min 1 redirect csv ./Messages.csv multiprocess redirect stdout - multiprocess redirect stderr stdout all users print messages maxtoprint 1 showlabels includespamtrash query "rfc822msgid:<PutMessageIDHere"

Look in the Labels column, if UNREAD is not in the column, the message has been read. If TRASH is in the column, the user has trashed it.

Ross

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/61e9edef-2be2-42b8-b37b-2232a07143d1n%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com

[Ross Scroggs]

Noah,

You're on the right track, you can speed the process with some parallel processing

gam config auto_batch_min 1 redirect redirect stdout ./DeleteMessage.txt multiprocess redirect stderr stdout all users delete messages maxtodelete 1 includespamtrash query "rfc822msgid:<PutMessageIDHere" doit

Ross

CONFIDENTIALITY NOTICE
 
This message and attachments included are intended only for the addressee (s). The information contained in this message is confidential and may constitute proprietary or non-public information under international, federal, and/or state laws. Unauthorized forwarding, printing, copying, distribution, or use of such information is strictly prohibited and may be unlawful. If you are not the addressee(s), please promptly delete this message and notify the sender of the delivery error by e-mail.

---

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/google-apps-manager/2fee9c53-9d6c-49ee-b431-4cbd45484356n%40googlegroups.com.

--

Ross Scroggs

ross.s...@gmail.com