RecipientEmailAddress but recipient information BEFORE DL expansion
I'm trying to get a list of the top email recipients in our environment using the EmailEvents table andRecipientEmailAddress in Defender 365/Sentinel. But, as the schema says, RecipientEmailAddress is the "address of the recipient, or email address of the recipient after distribution list expansion" How can I query on recipient info before DL expansion?