Hi all, Need help to build a query which helps to identify the users that possibly leaking /auto-forwarding emails to his personal email address (e.g. gmail) based on Exchange logs and also need to add exceptions when some forwarding are approved Sample exchange log 1 : {"AppId": "00000002-0000-0ff1-ce00-000000000000", "ClientAppId": "", "ClientIP": "98.98.98.98:65426", "CreationTime": "2020-12-11T14:44:23", "ExternalAccess": false, "Id": "720fba63-b1bf-4578-1eab-08d89de34066", "ObjectId": "123456\\1234567890", "Operation": "Set-InboxRule", "OrganizationId": "master", "OrganizationName": "abc.com", "OriginatingServer": "ABCDEFGHIJ (15.20.3632.023)", "Parameters": [{"Name": "AlwaysDeleteOutlookRulesBlob", "Value": "False"}, {"Name": "Force", "Value": "False"}, {"Name": "Identity", "Value": "Test"}, {"Name": "ForwardTo", "Value": "david@123.com;sam@abc.com"}, {"Name": "From", "Value": "sam@abc.com"}, {"Name": "Name", "Value": "Test"}, {"Name": "SubjectContainsWords", "Value": "TEST23"}, {"Name": "StopProcessingRules", "Value": "True"}], "RecordType": 1, "ResultStatus": "True", "SessionId": "84579310-05ab-4d3f-bd58-c8ebbe43da2f", "UserId": "chris@abc.net", "UserKey": "1003200077814EEE", "UserType": 2, "Version": 1, "Workload": "Exchange"} Company domain : abc.com ; auto forward rules configured to send emails to "david@123.com" is suspicious and that has to be alerted. ( Any domains other than abc.com and abc.net are considered as external and has to be alerted)
... View more