Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others
https://sockanalyst.com/patch-now/amadeus-airline-breach

Splunk
index=email (subject="*booking*" OR subject="*reservation*" OR subject="*itinerary*" OR subject="*rebook*" OR subject="*KrisFlyer*" OR subject="*Asia Miles*" OR subject="*Mileage*")
NOT src_user IN ("*@jal.com","*@jal.co.jp","*@ana.co.jp","*@cathaypacific.com","*@singaporeair.com.sg","*@malaysiaairlines.com","*@koreanair.com","*@flyasiana.com")
| stats count values(subject) as subjects by src_user, recipient

Sentinel
let airlines = dynamic(["jal.com","jal.co.jp","ana.co.jp","cathaypacific.com","singaporeair.com.sg","singaporeair.com","malaysiaairlines.com","koreanair.com","flyasiana.com"]);
EmailEvents
| where Subject has_any ("booking","reservation","itinerary","rebook","KrisFlyer","Asia Miles","Mileage")
| where not(SenderFromDomain has_any (airlines))
| summarize count(), make_set(Subject,10) by SenderFromAddress, RecipientEmailAddress, DeliveryAction