how to monitor and alert Auto-forwarding rule using O365 activity logs

[Newton]

Hi all,

Need help to build a query which helps   to identify the users that possibly leaking /auto-forwarding emails to his personal email address (e.g. gmail) based on Exchange logs and also need to add exceptions when some forwarding are approved
Sample exchange log 1 :

{"AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "", "ClientIP": "98.98.98.98:65426", "CreationTime": "2020-12-11T14:44:23", "ExternalAccess": false, "Id": "720fba63-b1bf-4578-1eab-08d89de34066", "ObjectId": "123456\\1234567890", "Operation": "Set-InboxRule", "OrganizationId": "master", "OrganizationName": "abc.com", "OriginatingServer": "ABCDEFGHIJ (15.20.3632.023)", "Parameters": [{"Name": "AlwaysDeleteOutlookRulesBlob", "Value": "False"}, {"Name": "Force", "Value": "False"}, {"Name": "Identity", "Value": "Test"}, {"Name": "ForwardTo", "Value": "david@123.com;sam@abc.com"}, {"Name": "From", "Value": "sam@abc.com"}, {"Name": "Name", "Value": "Test"}, {"Name": "SubjectContainsWords", "Value": "TEST23"}, {"Name": "StopProcessingRules", "Value": "True"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "84579310-05ab-4d3f-bd58-c8ebbe43da2f", "UserId": "chris@abc.net", "UserKey": "1003200077814EEE", "UserType": 2, "Version": 1, "Workload": "Exchange"}

Company domain : abc.com ;

auto forward rules configured to send emails to "david@123.com" is suspicious and that has to be alerted. ( Any domains other than abc.com and abc.net are considered as external and has to be alerted)

[Newton]

so far i have built till this query through which i get to look at the logs with a better view, but i could not figure out a way to create exception for approved domains, and also could not extract the right field as there are mutilple fields with the same name "value""

 Workload=Exchange (Operation=New-InboxRule OR Operation=Set-Mailbox OR Operation=UpdateInboxRules OR Operation=Set-InboxRule OR Operation=Disable-InboxRule OR Operation=Enable-InboxRule) (Parameters{}.Name=ForwardingSmtpAddress OR Parameters{}.Name=DeliverToMailboxAndForward OR Parameters{}.Name=RedirectT0 OR Parameters{}.Name= ForwardAsAttachmentTo OR Parameters{}.Name=ForwardTo) Parameters{}.Value!=””

| fields CreationTime ClientIP Operation UserId Parameters{}.Name Parameters{}.Value

| table CreationTime ClientIP Operation UserId Parameters{}.Name Parameters{}.Value

| sort -CreationTime

| rename ClientIP AS src_ip, CreationTime AS event_time, ObjectID AS Account_Name, “Parameters{}.Value” AS value, “Parameters{}.Name” AS value_name