Exchange Audit Event

Exchange administrative and mailbox audit events ingested from the Office 365 Management Activity API.

Part of the Exchange inventory.

Scan settings

Default scanning interval	Allowed scanning intervals	Data removal during incremental scan
Daily	Daily, Weekly, Bi-Weekly, Monthly, Never, Initial	No

Properties

Property	Type	Description	Automation placeholder
Client IP	String	Source IP from which the action was performed.	{{ExchangeAuditEvent.ClientIP}}
Initially Scanned	DateTime	Shows when this object was initially found in a scan.	{{ExchangeAuditEvent.CreatedTime}}
Event Id	String		{{ExchangeAuditEvent.DisplayName}}
Event Time	DateTime	When the action occurred (UTC).	{{ExchangeAuditEvent.EventTime}}
Last scan update	DateTime	Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change.	{{ExchangeAuditEvent.LastModifiedTime}}
Object Id	String	Identifier of the object affected by the action (e.g. mailbox UPN, rule name).	{{ExchangeAuditEvent.ObjectId}}
Operation	String	The cmdlet or audit operation that produced this event (e.g. 'Set-TransportRule', 'Add-MailboxPermission').	{{ExchangeAuditEvent.Operation}}
Parameters	String	JSON-encoded list of parameters passed to the cmdlet.	{{ExchangeAuditEvent.Parameters}}
Record Type	String	Audit record type: ExchangeAdmin, ExchangeItem, ExchangeItemGroup, ComplianceDLPExchange, etc. Allowed values: ComplianceDLPExchange, ExchangeAdmin, ExchangeItem, ExchangeItemGroup, SecurityComplianceCenterEOPCmdlet.	{{ExchangeAuditEvent.RecordType}}
Result Status	String	Whether the action succeeded or failed. Allowed values: Failed, PartiallySucceeded, Succeeded.	{{ExchangeAuditEvent.ResultStatus}}
Risk Score	Int32	Stores risk score	{{ExchangeAuditEvent.RiskScore}}
Risk Score Update	DateTime	Stores risk score update	{{ExchangeAuditEvent.RiskScoreLastUpdate}}
Risk Score Value	String	Stores risk score value like Low_Low	{{ExchangeAuditEvent.RiskScoreValue}}
Source Workload	String	Workload that produced the event (Exchange).	{{ExchangeAuditEvent.SourceWorkload}}
User	User	User who performed the action.	{{ExchangeAuditEvent.User}}
User Id	String	UPN of the user/admin who performed the action.	{{ExchangeAuditEvent.UserId}}
User name	String		{{ExchangeAuditEvent.UserName}}

Relations

Relation	Service	Description
User	Microsoft 365	All users registered in your tenant (internal, external)

Segments

This object does currently not have any segments.

Actions

This object does currently not have any actions.

Policies that check this object

Policy	Severity	Description
Mailbox forwarding setting changed	High	Detects audit events whose parameters indicate a mailbox forwarding setting was changed.
Mailbox permission granted	Medium	Detects audit events where mailbox or recipient permissions were added or removed.
Transport rule modified	High	Detects audit events where an Exchange transport rule was created, modified, or removed.