Often, Spam or phishing emails would be sent to my entire organization. other times, it would be sent to 10-15 people.
Is there any way to set a rule something like this;
"If an email arrives from a sender that sent more then X emails in the past hour, then notify an admin".
Like this, we can get alerts when something does not sound right, and act on it quickly.
Yet I know it is going to be many false positives, hence the reason I want alerts only and not blocking.
Does anything like this exist?