I believe this add-on (currently) only collects Exchange Online Audit Logs, not message-tracking logs. This would cover things like administrative access to a user's mailbox, sending on behalf of someone else, etc. You can configure it to audit more detailed information like the creation of different kinds of items, but I haven't seen a way yet to use this type of log to track all messages being sent (as opposed to mail items being created or modified).
Microsoft maintains message tracking logs in a searchable form for some period of time, and I'd also be interested to know how to collect them yourself for longer-term retention and analysis in Splunk. There's probably a way, but I haven't found it yet either.
... View more