...
...
Description
Events from an Exchange mailbox audit log for actions that are performed on a single item, such as creating or receiving an email message.
Log Structure
| Expand | ||
|---|---|---|
| ||
[ |
Table Fields
Field | Description |
|---|---|
TABLE | Office365ExchangeItem |
RECORDTYPE | RecordType is “2”, more details about RecordType here. |
APPID | AppId - No available documentation for this field. |
CLIENTAPPDID | ClientAppId - No available documentation for this field. |
LOGONTYPE | LogonType - Indicates the type of user who accessed the mailbox and performed the operation that was logged. |
INTERNALLOGONTYPE | InternalLogonType - Reserved for internal use. |
MAILBOXGUID | MailboxGuid - The Exchange GUID of the mailbox that was accessed. |
MAILBOXOWNERUPN | MailboxOwnerUPN - The email address of the person who owns the mailbox that was accessed. |
MAILBOXOWNERSID | MailboxOwnerSid - The SID of the mailbox owner. |
MAILBOXOWNERMASTERSID | MailboxOwnerMasterAccountSid - Mailbox owner account's master account SID. |
LOGONUSERSID | LogonUserSid - The SID of the user who performed the operation. |
LOGONUSERNAME | LogonUserDisplayName - The user-friendly name of the user who performed the operation. |
EXTERNALACCESS | ExternalAccess - This is true if the logon user's domain is different from the mailbox owner's domain. |
ORIGINATINGSERVER | OriginatingServer - This is from where the operation originated. |
ORGNAME | OrganizationName - The name of the tenant. |
CLIENTINFO | ClientInfoString - Information about the email client that was used to perform the operation, such as a browser version, Outlook version, and mobile device information. |
CLIENTADDR | ClientIPAddress - The IP address of the device that was used when the operation was logged. The IP address is displayed in either an IPv4 or IPv6 address format. |
CLIENTMACHINE | ClientMachineName - The machine name that hosts the Outlook client. |
CLIENTPROCESS | ClientProcessName - The email client that was used to access the mailbox. |
CLIENTVERSION | ClientVersion - The version of the email client . |
CLIENTREQID | ClientRequestId - No available documentation for this field. |
ITEM | Item - Represents the item upon which the operation was performed.
|
MODIFIEDPROPERTIES | ModifiedProperties - The property is included for admin events, such as adding a user as a member of a site or a site collection admin group. |
SENDADDR | SendAsUserSmtp - SMTP address of the user who is being impersonated. |
SENDMBGUID | SendAsUserMailboxGuid - The Exchange GUID of the mailbox that was accessed to send email as. |
SENDONADDR | SendOnBehalfOfUserSmtp - SMTP address of the user on whose behalf the email is sent. |
SENDONMBGUID | SendOnBehalfOfUserMailboxGuid - The Exchange GUID of the mailbox that was accessed to send mail on behalf of. |
SNAREDATAMAP | All unclassified field/s in the log will be pushed into the SNAREDATAMAP. |