Forum Discussion
BrandonConn007
Jan 16, 2024Copper Contributor
Any way to audit who/what deleted an Outlook calendar event via Sentinel?
A few users have reported that they are missing calendar events, all of them are recurring events. I have a few examples of meetings that appear in 1 person's calendar but not another's despite them being shown as an attendee (did not respond).
I used delegation and can see the original email message in deleted items, but it doesn't give an insight on the calendar object itself. Some individuals can also see a few items in their deleted items that show recurring appointments "Exchange Server re-created a meeting that was missing from your calendar."
Wondering how I can track down via KQL of who or what, or from what device (phone (outlook vs mail app, etc..) vs computer) the object was deleted from?
Thanks!
No RepliesBe the first to reply