RecipientEmailAddress but recipient information BEFORE DL expansion

Copper Contributor

I'm trying to get a list of the top email recipients in our environment using the EmailEvents table and RecipientEmailAddress in Defender 365/Sentinel.  But, as the schema says, RecipientEmailAddress is the "address of the recipient, or email address of the recipient after distribution list expansion"


How can I query on recipient info before DL expansion?

0 Replies