[Exchange online] How many mailbox received specific email?

[Kim Kheng Tan]

Hi,

I am new to Azure Sentinel. I am trying to run a query to check how many mailboxes received a particular email with a particular Subject, within a time period and I seem to have some trouble, will you be able to help? I am not able to run it in Microsoft search as the log I am trying to look at is more than 30 days.

From the query I ran

OfficeActivity

| where TimeGenerated > ago(360d)

| where OfficeWorkload == "Exchange"

| extend Subject_ = tostring(parse_json(AffectedItems)[0].Subject)

| where Subject_ == "xxxxxxxxxxx"

| summarize count() by Operation

So far I can see the operation summary are all about "delete" action. I am not interested in knowing the action taken after the email has been delivered, but I am interested who received the email.

Will Sentinel able to give me that visibility?

Thanks

[#2]

@Kim Kheng Tan 

The information regarding senders, receivers and subjects are available through the Message Trace report API. For now the Office 365 Sentinel connector does not integrate this API, but this is on developers' road map (c.f. this post). You can still can bypass this constraint by using the Message Trace report API through a Logic App. I will try to post how to do this in the next few days.

Now, regarding the logs retention, I don't think MS keeps those logs for a whole year unless you ask them so. But I'll let someone with more experience give you a hint on the subject.