Forum Discussion
[Exchange online] How many mailbox received specific email?
Hi,
I am new to Azure Sentinel. I am trying to run a query to check how many mailboxes received a particular email with a particular Subject, within a time period and I seem to have some trouble, will you be able to help? I am not able to run it in Microsoft search as the log I am trying to look at is more than 30 days.
From the query I ran
- Molx32Brass Contributor
The information regarding senders, receivers and subjects are available through the Message Trace report API. For now the Office 365 Sentinel connector does not integrate this API, but this is on developers' road map (c.f. this post). You can still can bypass this constraint by using the Message Trace report API through a Logic App. I will try to post how to do this in the next few days.
Now, regarding the logs retention, I don't think MS keeps those logs for a whole year unless you ask them so. But I'll let someone with more experience give you a hint on the subject.