OfficeActivity: is it possible to extract an email recipient ?

%3CLINGO-SUB%20id%3D%22lingo-sub-3031400%22%20slang%3D%22en-US%22%3EOfficeActivity%3A%20is%20it%20possible%20to%20extract%20an%20email%20recipient%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3031400%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3Ehere's%20the%20situation%3A%20my%20client%20wants%20a%20Sentinel%20workbook%20showing%20the%20most%20common%20email%20subject%20-%20so%20far%2C%20no%20problems%20-%20AND%20also%20showing%20the%20recipient.%20As%20Hamlet%20would%20say%2C%20there%20is%20the%20rub%3A%20is%20there%20a%20way%20to%20find%20an%20email%20recipient%20from%20OfficeActivity%20table%20%3F%20The%20%22send%22%20%2C%20%22sendas%22%2C%20%22sendonbehalf%22%20activities%20do%20not%20mention%20the%20mail%20recipient.%20Is%20there%20a%20way%20to%20collect%20this%20from%20OfficeActivity%20table%20or%20do%20I%20have%20to%20query%20Office%20directly%20via%20an%20API%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EP.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3031439%22%20slang%3D%22en-US%22%3ERe%3A%20OfficeActivity%3A%20is%20it%20possible%20to%20extract%20an%20email%20recipient%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3031439%22%20slang%3D%22en-US%22%3ENot%20sure%20if%20this%20is%20helpful%2C%20but%20it%20might%20give%20some%20insight%20about%20the%20subject%20%3A%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-sentinel-blog%2Foffice-365-email-activity-and-data-exfiltration-detection%2Fba-p%2F1169652%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-sentinel-blog%2Foffice-365-email-activity-and-data-exfiltration-detection%2Fba-p%2F1169652%3C%2FA%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi,

here's the situation: my client wants a Sentinel workbook showing the most common email subject - so far, no problems - AND also showing the recipient. As Hamlet would say, there is the rub: is there a way to find an email recipient from OfficeActivity table ? The "send" , "sendas", "sendonbehalf" activities do not mention the mail recipient. Is there a way to collect this from OfficeActivity table or do I have to query Office directly via an API ?

 

Regards,

 

P.

1 Reply