Video Screencast Help

malquery "or" instead of "and"

Created: 20 Nov 2012 | 1 comment

I'm trying to use malquery to find all e-mails sent to either of threee recipients.  It looks like malquery processes multiple -e options as ANDed.
 

e.g. malquery -p 30d -e RCPTS=bob@yahoo.com -e RCPTS=Alice@hotmail.com -e RCPTS=glen@gmail.com

Only seems to return  e-mails where bob, alice and glen are ALL recipients.

thoughts?

Comments 1 CommentJump to latest comment

patriot3w's picture

yes, multiple -e options is AND in between.

Why don't you try run 3 times?