Jan 18 2022 07:07 AM
I'm trying to get a list of the top email recipients in our environment using the EmailEvents table and RecipientEmailAddress in Defender 365/Sentinel. But, as the schema says, RecipientEmailAddress is the "address of the recipient, or email address of the recipient after distribution list expansion"
How can I query on recipient info before DL expansion?
Aug 28 2024 07:01 AM