RecipientEmailAddress but recipient information BEFORE DL expansion

%3CLINGO-SUB%20id%3D%22lingo-sub-3064647%22%20slang%3D%22en-US%22%3ERecipientEmailAddress%20but%20recipient%20information%20BEFORE%20DL%20expansion%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3064647%22%20slang%3D%22en-US%22%3E%3CP%3EI'm%20trying%20to%20get%20a%20list%20of%20the%20top%20email%20recipients%20in%20our%20environment%20using%20the%20EmailEvents%20table%20and%26nbsp%3B%3CSPAN%3ERecipientEmailAddress%20in%20Defender%20365%2FSentinel.%26nbsp%3B%20But%2C%20as%20the%20schema%20says%2C%20RecipientEmailAddress%20is%20the%20%22address%20of%20the%20recipient%2C%20or%20email%20address%20of%20the%20recipient%20after%20distribution%20list%20expansion%22%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EHow%20can%20I%20query%20on%20recipient%20info%20before%20DL%20expansion%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3064647%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Online%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Ereporting%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Esentinel%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Contributor

I'm trying to get a list of the top email recipients in our environment using the EmailEvents table and RecipientEmailAddress in Defender 365/Sentinel.  But, as the schema says, RecipientEmailAddress is the "address of the recipient, or email address of the recipient after distribution list expansion"

 

How can I query on recipient info before DL expansion?

0 Replies