Hi, I've been trying to get email trace for office365 exchange using the addon in subject.  No data is coming under this sourcetype   sourcetype: ms:o365:reporting:messagetrace    checked ta_ms_o365_reporting_ms_o365_message_trace.log  no errors are seen. No attempts of using the API is seen I have the below configuration set for the input Not sure about the "delay throttle" part. if there are default values i don't mind using them What am I missing here?  ... View more

Hi, How is it possible that a correlation rule is triggering notables based on data dates back to a previous month?  I have a rule with the below time range modifiers  It has just been triggered and I tried searching for the matching event for the past day with no luck.  Expanded my time range to 90 days and I found matching events during the past month only. Is this scenario familiar to anyone?  ... View more