RecipientEmailAddress but recipient information BEFORE DL expansion

Occasional Contributor

I'm trying to get a list of the top email recipients in our environment using the EmailEvents table and RecipientEmailAddress in Defender 365/Sentinel.  But, as the schema says, RecipientEmailAddress is the "address of the recipient, or email address of the recipient after distribution list expansion"

 

How can I query on recipient info before DL expansion?

0 Replies