Splunk Search

how to monitor and alert Auto-forwarding rule using O365 activity logs


Hi all,

Need help to build a query which helps   to identify the users that possibly leaking /auto-forwarding emails to his personal email address (e.g. gmail) based on Exchange logs and also need to add exceptions when some forwarding are approved
Sample exchange log 1 :

{"AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "", "ClientIP": "", "CreationTime": "2020-12-11T14:44:23", "ExternalAccess": false, "Id": "720fba63-b1bf-4578-1eab-08d89de34066", "ObjectId": "123456\\1234567890", "Operation": "Set-InboxRule", "OrganizationId": "master", "OrganizationName": "abc.com", "OriginatingServer": "ABCDEFGHIJ (15.20.3632.023)", "Parameters": [{"Name": "AlwaysDeleteOutlookRulesBlob", "Value": "False"}, {"Name": "Force", "Value": "False"}, {"Name": "Identity", "Value": "Test"}, {"Name": "ForwardTo", "Value": "david@123.com;sam@abc.com"}, {"Name": "From", "Value": "sam@abc.com"}, {"Name": "Name", "Value": "Test"}, {"Name": "SubjectContainsWords", "Value": "TEST23"}, {"Name": "StopProcessingRules", "Value": "True"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "84579310-05ab-4d3f-bd58-c8ebbe43da2f", "UserId": "chris@abc.net", "UserKey": "1003200077814EEE", "UserType": 2, "Version": 1, "Workload": "Exchange"}

Company domain : abc.com ;

auto forward rules configured to send emails to "david@123.com" is suspicious and that has to be alerted. ( Any domains other than abc.com and abc.net are considered as external and has to be alerted)

Labels (2)
0 Karma


so far i have built till this query through which i get to look at the logs with a better view, but i could not figure out a way to create exception for approved domains, and also could not extract the right field as there are mutilple fields with the same name "value""

 Workload=Exchange (Operation=New-InboxRule OR Operation=Set-Mailbox OR Operation=UpdateInboxRules OR Operation=Set-InboxRule OR Operation=Disable-InboxRule OR Operation=Enable-InboxRule) (Parameters{}.Name=ForwardingSmtpAddress OR Parameters{}.Name=DeliverToMailboxAndForward OR Parameters{}.Name=RedirectT0 OR Parameters{}.Name= ForwardAsAttachmentTo OR Parameters{}.Name=ForwardTo) Parameters{}.Value!=””

| fields CreationTime ClientIP Operation UserId Parameters{}.Name Parameters{}.Value

| table CreationTime ClientIP Operation UserId Parameters{}.Name Parameters{}.Value

| sort -CreationTime

| rename ClientIP AS src_ip, CreationTime AS event_time, ObjectID AS Account_Name, “Parameters{}.Value” AS value, “Parameters{}.Name” AS value_name

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...