microsoft exchange

Expression

product = "microsoft exchange"

Fields

There are no fields for this extension.

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	result
	sender	Legacy	✓
	bytes	Legacy		✓
	recipients
	dest_ip	Legacy	✓	✓
	recipient
	src_host	Legacy	✓	✓
	email_subject
app-login	src_ip	Default	✓	✓
	protocol	Default			✓
	bytes_out	Default			✓
	bytes_in	Default			✓
	dest_ip	Default		✓
	user_agent	Default			✓
email-receive	src_ip	Default		✓
	external_address	Default			✓
	return_path	Default			✓
	event_code	Default			✓
	bytes	Default			✓
	dest_ip	Default		✓
	log_source	Default			✓
	dest_host	Default		✓
	traffic_type	Default			✓
	src_host	Default		✓
	direction	Default			✓
email-send	traffic_type	Default			✓
	src_host	Default		✓
	src_ip	Default		✓
	src_port	Default			✓
	return_path	Default			✓
	event_code	Default			✓
	bytes	Default			✓
	process_name	Default			✓
	dest_ip	Default		✓
	log_source	Default			✓
	user_sid	Default			✓
	dest_host	Default		✓
	direction	Default			✓
mailbox-create	app	Default			✓
	email_address	Default			✓
	email_user	Default			✓
	email_domain	Default			✓
	operation	Default			✓
mailbox-item-create	app	Default			✓
	email_address	Default			✓
	email_user	Default			✓
	email_domain	Default			✓
	operation	Default			✓
mailbox-item-delete	app	Default			✓
	src_ip	Default		✓
	email_address	Default			✓
	email_user	Default			✓
	additional_info	Default			✓
	email_domain	Default			✓
	user	Default		✓
	operation	Default			✓
	object	Default			✓
mailbox-item-modify	app	Default			✓
	email_address	Default			✓
	email_user	Default			✓
	email_domain	Default			✓
	operation	Default			✓
mailbox-modify	app	Default			✓
	email_address	Default			✓
	email_user	Default			✓
	email_domain	Default			✓
	operation	Default			✓
user-modify	app
	email_address
	email_user
	email_domain
	operation