{ "events": [ { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:49\",\"ExternalAccess\":true,\"Id\":\"1c7412a6-858d-49ff-3f93-08d7ac0f45bf\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:49", "ExternalAccess": true, "Id": "1c7412a6-858d-49ff-3f93-08d7ac0f45bf", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"6c3454e1-1a13-411b-bed1-08d7adfc0c09\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "6c3454e1-1a13-411b-bed1-08d7adfc0c09", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:03\",\"ExternalAccess\":true,\"Id\":\"b5131b23-3efb-481a-c05b-08d7ac0f2a82\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:03", "ExternalAccess": true, "Id": "b5131b23-3efb-481a-c05b-08d7ac0f2a82", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:09\",\"ExternalAccess\":true,\"Id\":\"ef597809-1c52-4a85-7cce-08d7adfc0939\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\2c6709f0-beaf-4ffd-99ea-d02c796c25d3\",\"Operation\":\"Install-DefaultSharingPolicy\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Organization\",\"Value\":\"testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:09", "ExternalAccess": true, "Id": "ef597809-1c52-4a85-7cce-08d7adfc0939", "ObjectId": "testsiem.onmicrosoft.com\\2c6709f0-beaf-4ffd-99ea-d02c796c25d3", "Operation": "Install-DefaultSharingPolicy", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Organization", "Value": "testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:09\",\"ExternalAccess\":true,\"Id\":\"362ff802-6df6-47e5-09a2-08d7adfc095b\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Admin Audit Log Settings\",\"Operation\":\"Install-AdminAuditLogConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Organization\",\"Value\":\"testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:09", "ExternalAccess": true, "Id": "362ff802-6df6-47e5-09a2-08d7adfc095b", "ObjectId": "testsiem.onmicrosoft.com\\Admin Audit Log Settings", "Operation": "Install-AdminAuditLogConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Organization", "Value": "testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:13\",\"ExternalAccess\":true,\"Id\":\"ea769bfc-fa67-465c-767a-08d7adfc0b7b\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Transport Settings\",\"Operation\":\"Set-TransportConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\"},{\"Name\":\"OrganizationFederatedMailbox\",\"Value\":\"FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:13", "ExternalAccess": true, "Id": "ea769bfc-fa67-465c-767a-08d7adfc0b7b", "ObjectId": "testsiem.onmicrosoft.com\\Transport Settings", "Operation": "Set-TransportConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com" }, { "Name": "OrganizationFederatedMailbox", "Value": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:43\",\"ExternalAccess\":true,\"Id\":\"168019d2-1e8a-4394-e90b-08d7ac0f1e69\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}\"},{\"Name\":\"UMDataStorage\",\"Value\":\"True\"},{\"Name\":\"Force\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:43", "ExternalAccess": true, "Id": "168019d2-1e8a-4394-e90b-08d7ac0f1e69", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "Arbitration", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}" }, { "Name": "UMDataStorage", "Value": "True" }, { "Name": "Force", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:34\",\"ExternalAccess\":true,\"Id\":\"0d7995da-038f-40d9-2765-08d7ac0f3d4d\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\OwaMailboxPolicy-Default\",\"Operation\":\"Set-OwaMailboxPolicy\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"InstantMessagingType\",\"Value\":\"Ocs\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\\\\OwaMailboxPolicy-Default\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:34", "ExternalAccess": true, "Id": "0d7995da-038f-40d9-2765-08d7ac0f3d4d", "ObjectId": "testsiem.onmicrosoft.com\\OwaMailboxPolicy-Default", "Operation": "Set-OwaMailboxPolicy", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "InstantMessagingType", "Value": "Ocs" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com\\OwaMailboxPolicy-Default" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:20\",\"ExternalAccess\":true,\"Id\":\"b9f4dff2-c7f5-41eb-eae8-08d7ac0f3492\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:20", "ExternalAccess": true, "Id": "b9f4dff2-c7f5-41eb-eae8-08d7ac0f3492", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:17\",\"ExternalAccess\":true,\"Id\":\"2202ec45-7abc-49dd-e35e-08d7adfc0e15\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:17", "ExternalAccess": true, "Id": "2202ec45-7abc-49dd-e35e-08d7adfc0e15", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:04\",\"ExternalAccess\":true,\"Id\":\"a0063917-bb25-4c17-fe2e-08d7ac0f0769\",\"ObjectId\":\"testsiem.onmicrosoft.com\",\"Operation\":\"Enable-AddressListPaging\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DoNotUpdateRecipients\",\"Value\":\"True\"},{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:04", "ExternalAccess": true, "Id": "a0063917-bb25-4c17-fe2e-08d7ac0f0769", "ObjectId": "testsiem.onmicrosoft.com", "Operation": "Enable-AddressListPaging", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DoNotUpdateRecipients", "Value": "True" }, { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:58\",\"ExternalAccess\":true,\"Id\":\"a324e83b-d1a3-4855-db2a-08d7ac0f277b\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:58", "ExternalAccess": true, "Id": "a324e83b-d1a3-4855-db2a-08d7ac0f277b", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"ebda487f-6177-432a-e91d-08d7adfc0d0d\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "ebda487f-6177-432a-e91d-08d7adfc0d0d", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:09\",\"ExternalAccess\":true,\"Id\":\"7dafe4a3-487a-46ec-dadc-08d7ac0f2e06\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:09", "ExternalAccess": true, "Id": "7dafe4a3-487a-46ec-dadc-08d7ac0f2e06", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"7b5e608f-0a09-4251-8922-08d7adfc0d15\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "7b5e608f-0a09-4251-8922-08d7adfc0d15", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:09\",\"ExternalAccess\":true,\"Id\":\"7dafe4a3-487a-46ec-dadc-08d7ac0f2e06\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:09", "ExternalAccess": true, "Id": "7dafe4a3-487a-46ec-dadc-08d7ac0f2e06", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:18\",\"ExternalAccess\":true,\"Id\":\"a4912729-9b49-43b3-d21f-08d7adfc0e8e\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"TenantAllowBlockLists\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:18", "ExternalAccess": true, "Id": "a4912729-9b49-43b3-d21f-08d7adfc0e8e", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "TenantAllowBlockLists", "Value": "True" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:55\",\"ExternalAccess\":true,\"Id\":\"514d0e07-410f-469c-a7f9-08d7ac0f496e\",\"ObjectId\":\"testsiem.onmicrosoft.com\",\"Operation\":\"Set-TenantObjectVersion\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:55", "ExternalAccess": true, "Id": "514d0e07-410f-469c-a7f9-08d7ac0f496e", "ObjectId": "testsiem.onmicrosoft.com", "Operation": "Set-TenantObjectVersion", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:13\",\"ExternalAccess\":true,\"Id\":\"ea769bfc-fa67-465c-767a-08d7adfc0b7b\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Transport Settings\",\"Operation\":\"Set-TransportConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\"},{\"Name\":\"OrganizationFederatedMailbox\",\"Value\":\"FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:13", "ExternalAccess": true, "Id": "ea769bfc-fa67-465c-767a-08d7adfc0b7b", "ObjectId": "testsiem.onmicrosoft.com\\Transport Settings", "Operation": "Set-TransportConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com" }, { "Name": "OrganizationFederatedMailbox", "Value": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:08\",\"ExternalAccess\":true,\"Id\":\"e022fa0d-13b2-4314-b707-08d7adfc0868\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Transport Settings\",\"Operation\":\"Set-TransportConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"},{\"Name\":\"SupervisionTags\",\"Value\":\"Reject;Allow\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:08", "ExternalAccess": true, "Id": "e022fa0d-13b2-4314-b707-08d7adfc0868", "ObjectId": "testsiem.onmicrosoft.com\\Transport Settings", "Operation": "Set-TransportConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" }, { "Name": "SupervisionTags", "Value": "Reject;Allow" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:55\",\"ExternalAccess\":true,\"Id\":\"514d0e07-410f-469c-a7f9-08d7ac0f496e\",\"ObjectId\":\"testsiem.onmicrosoft.com\",\"Operation\":\"Set-TenantObjectVersion\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:55", "ExternalAccess": true, "Id": "514d0e07-410f-469c-a7f9-08d7ac0f496e", "ObjectId": "testsiem.onmicrosoft.com", "Operation": "Set-TenantObjectVersion", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:52\",\"ExternalAccess\":true,\"Id\":\"8a3c4f54-f2de-4717-dd56-08d7ac0f23be\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Transport Settings\",\"Operation\":\"Set-TransportConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\"},{\"Name\":\"OrganizationFederatedMailbox\",\"Value\":\"FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:52", "ExternalAccess": true, "Id": "8a3c4f54-f2de-4717-dd56-08d7ac0f23be", "ObjectId": "testsiem.onmicrosoft.com\\Transport Settings", "Operation": "Set-TransportConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com" }, { "Name": "OrganizationFederatedMailbox", "Value": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:49\",\"ExternalAccess\":true,\"Id\":\"9eb764a6-fee5-4c3a-6adc-08d7ac0f220f\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"OMEncryptionStore\",\"Value\":\"True\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:49", "ExternalAccess": true, "Id": "9eb764a6-fee5-4c3a-6adc-08d7ac0f220f", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "OMEncryptionStore", "Value": "True" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:18\",\"ExternalAccess\":true,\"Id\":\"a4912729-9b49-43b3-d21f-08d7adfc0e8e\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"TenantAllowBlockLists\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:18", "ExternalAccess": true, "Id": "a4912729-9b49-43b3-d21f-08d7adfc0e8e", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "TenantAllowBlockLists", "Value": "True" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:56\",\"ExternalAccess\":true,\"Id\":\"d83e97f0-951c-4ccc-630e-08d7ac0f267e\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:56", "ExternalAccess": true, "Id": "d83e97f0-951c-4ccc-630e-08d7ac0f267e", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:17\",\"ExternalAccess\":true,\"Id\":\"2cbbd2bb-607e-49b1-c02c-08d7adfc0e1c\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:17", "ExternalAccess": true, "Id": "2cbbd2bb-607e-49b1-c02c-08d7adfc0e1c", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:57\",\"ExternalAccess\":true,\"Id\":\"165a283d-6f9b-4dc2-1b86-08d7ac0f273c\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:57", "ExternalAccess": true, "Id": "165a283d-6f9b-4dc2-1b86-08d7ac0f273c", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:16\",\"ExternalAccess\":true,\"Id\":\"979931d3-c99d-45b1-14e1-08d7ac0f3209\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:16", "ExternalAccess": true, "Id": "979931d3-c99d-45b1-14e1-08d7ac0f3209", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:20\",\"ExternalAccess\":true,\"Id\":\"4bddac31-664e-4432-d181-08d7ac0f34d2\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:20", "ExternalAccess": true, "Id": "4bddac31-664e-4432-d181-08d7ac0f34d2", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:14\",\"ExternalAccess\":true,\"Id\":\"4d2e1010-489d-4aa0-e300-08d7ac0f314c\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:14", "ExternalAccess": true, "Id": "4d2e1010-489d-4aa0-e300-08d7ac0f314c", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:44\",\"ExternalAccess\":true,\"Id\":\"e79cb83c-25b7-4777-57f0-08d7ac0f1f74\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"Management\",\"Value\":\"True\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"DisplayName\",\"Value\":\"Microsoft Exchange Migration\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"9 GB (9,663,676,416 bytes)\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"Migration\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:44", "ExternalAccess": true, "Id": "e79cb83c-25b7-4777-57f0-08d7ac0f1f74", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "ProhibitSendReceiveQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "Management", "Value": "True" }, { "Name": "Force", "Value": "True" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "DisplayName", "Value": "Microsoft Exchange Migration" }, { "Name": "IssueWarningQuota", "Value": "9 GB (9,663,676,416 bytes)" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "Migration", "Value": "True" }, { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "ProhibitSendQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136" }, { "Name": "Arbitration", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"ee2a5c48-f068-4672-3e34-08d7adfc0bf4\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "ee2a5c48-f068-4672-3e34-08d7adfc0bf4", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"d3533d4d-f62f-4731-d0c9-08d7adfc0c7b\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "d3533d4d-f62f-4731-d0c9-08d7adfc0c7b", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:20\",\"ExternalAccess\":true,\"Id\":\"b9f4dff2-c7f5-41eb-eae8-08d7ac0f3492\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:20", "ExternalAccess": true, "Id": "b9f4dff2-c7f5-41eb-eae8-08d7ac0f3492", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:08\",\"ExternalAccess\":true,\"Id\":\"bc03d223-966c-4e33-6cf7-08d7ac0f2d88\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:08", "ExternalAccess": true, "Id": "bc03d223-966c-4e33-6cf7-08d7ac0f2d88", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:20\",\"ExternalAccess\":true,\"Id\":\"b9f4dff2-c7f5-41eb-eae8-08d7ac0f3492\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:20", "ExternalAccess": true, "Id": "b9f4dff2-c7f5-41eb-eae8-08d7ac0f3492", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:09\",\"ExternalAccess\":true,\"Id\":\"7a500a7f-cc56-4dfd-d740-08d7ac0f2e45\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:09", "ExternalAccess": true, "Id": "7a500a7f-cc56-4dfd-d740-08d7ac0f2e45", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:10\",\"ExternalAccess\":true,\"Id\":\"6047e3da-8661-44a4-6fd2-08d7ac0f2e85\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:10", "ExternalAccess": true, "Id": "6047e3da-8661-44a4-6fd2-08d7ac0f2e85", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:21\",\"ExternalAccess\":true,\"Id\":\"a61cdc9a-89ef-402b-102c-08d7ac0f3592\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:21", "ExternalAccess": true, "Id": "a61cdc9a-89ef-402b-102c-08d7ac0f3592", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"d16f181c-257c-4d40-45e1-08d7adfc0c02\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "d16f181c-257c-4d40-45e1-08d7adfc0c02", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:42\",\"ExternalAccess\":true,\"Id\":\"27fdc2ec-edbd-445c-92bd-08d7ac0f1dc6\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"UMGrammar\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"MaxSendSize\",\"Value\":\"1 GB (1,073,741,824 bytes)\"},{\"Name\":\"MailRouting\",\"Value\":\"True\"},{\"Name\":\"MessageTracking\",\"Value\":\"True\"},{\"Name\":\"OMEncryption\",\"Value\":\"True\"},{\"Name\":\"OABGen\",\"Value\":\"True\"},{\"Name\":\"ClientExtensions\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}\"},{\"Name\":\"GMGen\",\"Value\":\"True\"},{\"Name\":\"SuiteServiceStorage\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:42", "ExternalAccess": true, "Id": "27fdc2ec-edbd-445c-92bd-08d7ac0f1dc6", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "Force", "Value": "True" }, { "Name": "UMGrammar", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "MaxSendSize", "Value": "1 GB (1,073,741,824 bytes)" }, { "Name": "MailRouting", "Value": "True" }, { "Name": "MessageTracking", "Value": "True" }, { "Name": "OMEncryption", "Value": "True" }, { "Name": "OABGen", "Value": "True" }, { "Name": "ClientExtensions", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}" }, { "Name": "GMGen", "Value": "True" }, { "Name": "SuiteServiceStorage", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:55\",\"ExternalAccess\":true,\"Id\":\"0caecd44-0161-44e5-0e45-08d7ac0f49d6\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Admin Audit Log Settings\",\"Operation\":\"Set-AdminAuditLogConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"},{\"Name\":\"AdminAuditLogEnabled\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:55", "ExternalAccess": true, "Id": "0caecd44-0161-44e5-0e45-08d7ac0f49d6", "ObjectId": "testsiem.onmicrosoft.com\\Admin Audit Log Settings", "Operation": "Set-AdminAuditLogConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" }, { "Name": "AdminAuditLogEnabled", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:52\",\"ExternalAccess\":true,\"Id\":\"fd804781-7d7f-4d3a-1ef0-08d7ac0f47e4\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Transport Settings\",\"Operation\":\"Set-TransportConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\"},{\"Name\":\"HygieneSuite\",\"Value\":\"Premium\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:52", "ExternalAccess": true, "Id": "fd804781-7d7f-4d3a-1ef0-08d7ac0f47e4", "ObjectId": "testsiem.onmicrosoft.com\\Transport Settings", "Operation": "Set-TransportConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com" }, { "Name": "HygieneSuite", "Value": "Premium" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:52\",\"ExternalAccess\":true,\"Id\":\"8a3c4f54-f2de-4717-dd56-08d7ac0f23be\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Transport Settings\",\"Operation\":\"Set-TransportConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\"},{\"Name\":\"OrganizationFederatedMailbox\",\"Value\":\"FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:52", "ExternalAccess": true, "Id": "8a3c4f54-f2de-4717-dd56-08d7ac0f23be", "ObjectId": "testsiem.onmicrosoft.com\\Transport Settings", "Operation": "Set-TransportConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com" }, { "Name": "OrganizationFederatedMailbox", "Value": "FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042@testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:06\",\"ExternalAccess\":true,\"Id\":\"627aa8ff-1411-475d-d202-08d7ac0f08a5\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\ExchangeAssistance\",\"Operation\":\"New-ExchangeAssistanceConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Organization\",\"Value\":\"testsiem.onmicrosoft.com\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:06", "ExternalAccess": true, "Id": "627aa8ff-1411-475d-d202-08d7ac0f08a5", "ObjectId": "testsiem.onmicrosoft.com\\ExchangeAssistance", "Operation": "New-ExchangeAssistanceConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Organization", "Value": "testsiem.onmicrosoft.com" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:12\",\"ExternalAccess\":true,\"Id\":\"425128e3-4281-42f6-4ec7-08d7adfc0acd\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"Management\",\"Value\":\"True\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"DisplayName\",\"Value\":\"Microsoft Exchange Migration\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"9 GB (9,663,676,416 bytes)\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"Migration\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:12", "ExternalAccess": true, "Id": "425128e3-4281-42f6-4ec7-08d7adfc0acd", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "ProhibitSendReceiveQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "Management", "Value": "True" }, { "Name": "Force", "Value": "True" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "DisplayName", "Value": "Microsoft Exchange Migration" }, { "Name": "IssueWarningQuota", "Value": "9 GB (9,663,676,416 bytes)" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "Migration", "Value": "True" }, { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "ProhibitSendQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136" }, { "Name": "Arbitration", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:18\",\"ExternalAccess\":true,\"Id\":\"a4912729-9b49-43b3-d21f-08d7adfc0e8e\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"TenantAllowBlockLists\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:18", "ExternalAccess": true, "Id": "a4912729-9b49-43b3-d21f-08d7adfc0e8e", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "TenantAllowBlockLists", "Value": "True" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/TenantAllowBlocLists_F0767F09-6B4C-4F78-9234-2C0481176063" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:21\",\"ExternalAccess\":true,\"Id\":\"a61cdc9a-89ef-402b-102c-08d7ac0f3592\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:21", "ExternalAccess": true, "Id": "a61cdc9a-89ef-402b-102c-08d7ac0f3592", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"8126fd52-b16b-45c5-6aff-08d7adfc0c97\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "8126fd52-b16b-45c5-6aff-08d7adfc0c97", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"70f24b65-0224-473b-49b8-08d7adfc0c83\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "70f24b65-0224-473b-49b8-08d7adfc0c83", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:17\",\"ExternalAccess\":true,\"Id\":\"515c88f2-2cbf-4214-2d9b-08d7adfc0e0f\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:17", "ExternalAccess": true, "Id": "515c88f2-2cbf-4214-2d9b-08d7adfc0e0f", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:57\",\"ExternalAccess\":true,\"Id\":\"02c7f756-40e0-4c47-d49d-08d7ac0f26bd\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:57", "ExternalAccess": true, "Id": "02c7f756-40e0-4c47-d49d-08d7ac0f26bd", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:02\",\"ExternalAccess\":true,\"Id\":\"40786a66-fbd5-4a24-d9af-08d7ac0f2a42\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:02", "ExternalAccess": true, "Id": "40786a66-fbd5-4a24-d9af-08d7ac0f2a42", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"ebda487f-6177-432a-e91d-08d7adfc0d0d\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "ebda487f-6177-432a-e91d-08d7adfc0d0d", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:51\",\"ExternalAccess\":true,\"Id\":\"93d5f028-263c-45f1-dcf9-08d7ac0f2378\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"DisplayName\",\"Value\":\"Microsoft Exchange\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"9 GB (9,663,676,416 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:51", "ExternalAccess": true, "Id": "93d5f028-263c-45f1-dcf9-08d7ac0f2378", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "DisplayName", "Value": "Microsoft Exchange" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "9 GB (9,663,676,416 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042" }, { "Name": "ProhibitSendReceiveQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:17\",\"ExternalAccess\":true,\"Id\":\"1eea5379-4c86-4d6f-00cf-08d7adfc0e23\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:17", "ExternalAccess": true, "Id": "1eea5379-4c86-4d6f-00cf-08d7adfc0e23", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:17\",\"ExternalAccess\":true,\"Id\":\"2202ec45-7abc-49dd-e35e-08d7adfc0e15\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:17", "ExternalAccess": true, "Id": "2202ec45-7abc-49dd-e35e-08d7adfc0e15", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:23\",\"ExternalAccess\":true,\"Id\":\"80d8b808-c24c-4359-24cf-08d7adfc11e3\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\",\"Operation\":\"Set-RecipientEnforcementProvisioningPolicy\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\"},{\"Name\":\"PublicFolderHierarchyMailboxCountQuota\",\"Value\":\"100\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:23", "ExternalAccess": true, "Id": "80d8b808-c24c-4359-24cf-08d7adfc11e3", "ObjectId": "testsiem.onmicrosoft.com\\Recipient Quota Policy", "Operation": "Set-RecipientEnforcementProvisioningPolicy", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com\\Recipient Quota Policy" }, { "Name": "PublicFolderHierarchyMailboxCountQuota", "Value": "100" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:24\",\"ExternalAccess\":true,\"Id\":\"9edbf9fe-f844-401f-e9ec-08d7adfc1242\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Admin Audit Log Settings\",\"Operation\":\"Set-AdminAuditLogConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"},{\"Name\":\"AdminAuditLogEnabled\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:24", "ExternalAccess": true, "Id": "9edbf9fe-f844-401f-e9ec-08d7adfc1242", "ObjectId": "testsiem.onmicrosoft.com\\Admin Audit Log Settings", "Operation": "Set-AdminAuditLogConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" }, { "Name": "AdminAuditLogEnabled", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"7b5e608f-0a09-4251-8922-08d7adfc0d15\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "7b5e608f-0a09-4251-8922-08d7adfc0d15", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:17\",\"ExternalAccess\":true,\"Id\":\"2cbbd2bb-607e-49b1-c02c-08d7adfc0e1c\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:17", "ExternalAccess": true, "Id": "2cbbd2bb-607e-49b1-c02c-08d7adfc0e1c", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:24\",\"ExternalAccess\":true,\"Id\":\"9edbf9fe-f844-401f-e9ec-08d7adfc1242\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Admin Audit Log Settings\",\"Operation\":\"Set-AdminAuditLogConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"},{\"Name\":\"AdminAuditLogEnabled\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:24", "ExternalAccess": true, "Id": "9edbf9fe-f844-401f-e9ec-08d7adfc1242", "ObjectId": "testsiem.onmicrosoft.com\\Admin Audit Log Settings", "Operation": "Set-AdminAuditLogConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" }, { "Name": "AdminAuditLogEnabled", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:34\",\"ExternalAccess\":true,\"Id\":\"0d7995da-038f-40d9-2765-08d7ac0f3d4d\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\OwaMailboxPolicy-Default\",\"Operation\":\"Set-OwaMailboxPolicy\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"InstantMessagingType\",\"Value\":\"Ocs\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\\\\OwaMailboxPolicy-Default\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:34", "ExternalAccess": true, "Id": "0d7995da-038f-40d9-2765-08d7ac0f3d4d", "ObjectId": "testsiem.onmicrosoft.com\\OwaMailboxPolicy-Default", "Operation": "Set-OwaMailboxPolicy", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "InstantMessagingType", "Value": "Ocs" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com\\OwaMailboxPolicy-Default" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:12\",\"ExternalAccess\":true,\"Id\":\"425128e3-4281-42f6-4ec7-08d7adfc0acd\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"Management\",\"Value\":\"True\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"DisplayName\",\"Value\":\"Microsoft Exchange Migration\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"9 GB (9,663,676,416 bytes)\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"Migration\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:12", "ExternalAccess": true, "Id": "425128e3-4281-42f6-4ec7-08d7adfc0acd", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "ProhibitSendReceiveQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "Management", "Value": "True" }, { "Name": "Force", "Value": "True" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "DisplayName", "Value": "Microsoft Exchange Migration" }, { "Name": "IssueWarningQuota", "Value": "9 GB (9,663,676,416 bytes)" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "Migration", "Value": "True" }, { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "ProhibitSendQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136" }, { "Name": "Arbitration", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"6ddabbf8-4b7c-4982-2683-08d7adfc0c10\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "6ddabbf8-4b7c-4982-2683-08d7adfc0c10", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:13\",\"ExternalAccess\":true,\"Id\":\"e6a88958-ff2a-4e9b-d681-08d7adfc0b73\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"DisplayName\",\"Value\":\"Microsoft Exchange\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"9 GB (9,663,676,416 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:13", "ExternalAccess": true, "Id": "e6a88958-ff2a-4e9b-d681-08d7adfc0b73", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "DisplayName", "Value": "Microsoft Exchange" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "9 GB (9,663,676,416 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042" }, { "Name": "ProhibitSendReceiveQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:02\",\"ExternalAccess\":true,\"Id\":\"f580aae6-d0d5-4204-1a13-08d7ac0f2a03\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:02", "ExternalAccess": true, "Id": "f580aae6-d0d5-4204-1a13-08d7ac0f2a03", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:57\",\"ExternalAccess\":true,\"Id\":\"165a283d-6f9b-4dc2-1b86-08d7ac0f273c\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:57", "ExternalAccess": true, "Id": "165a283d-6f9b-4dc2-1b86-08d7ac0f273c", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"2db154f6-63ae-4a31-c548-08d7adfc0d1d\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "2db154f6-63ae-4a31-c548-08d7adfc0d1d", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:21\",\"ExternalAccess\":true,\"Id\":\"a61cdc9a-89ef-402b-102c-08d7ac0f3592\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:21", "ExternalAccess": true, "Id": "a61cdc9a-89ef-402b-102c-08d7ac0f3592", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:17\",\"ExternalAccess\":true,\"Id\":\"2202ec45-7abc-49dd-e35e-08d7adfc0e15\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:17", "ExternalAccess": true, "Id": "2202ec45-7abc-49dd-e35e-08d7adfc0e15", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:04\",\"ExternalAccess\":true,\"Id\":\"a0063917-bb25-4c17-fe2e-08d7ac0f0769\",\"ObjectId\":\"testsiem.onmicrosoft.com\",\"Operation\":\"Enable-AddressListPaging\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DoNotUpdateRecipients\",\"Value\":\"True\"},{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:04", "ExternalAccess": true, "Id": "a0063917-bb25-4c17-fe2e-08d7ac0f0769", "ObjectId": "testsiem.onmicrosoft.com", "Operation": "Enable-AddressListPaging", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DoNotUpdateRecipients", "Value": "True" }, { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:55\",\"ExternalAccess\":true,\"Id\":\"0caecd44-0161-44e5-0e45-08d7ac0f49d6\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Admin Audit Log Settings\",\"Operation\":\"Set-AdminAuditLogConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"},{\"Name\":\"AdminAuditLogEnabled\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:55", "ExternalAccess": true, "Id": "0caecd44-0161-44e5-0e45-08d7ac0f49d6", "ObjectId": "testsiem.onmicrosoft.com\\Admin Audit Log Settings", "Operation": "Set-AdminAuditLogConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" }, { "Name": "AdminAuditLogEnabled", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:24\",\"ExternalAccess\":true,\"Id\":\"2cb36c1c-1368-4483-9801-08d7adfc11fe\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\ExchangeAssistance15\",\"Operation\":\"Set-ExchangeAssistanceConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\"},{\"Name\":\"PrivacyStatementURL\",\"Value\":\"http://go.microsoft.com/fwlink/?LinkID=259417\"},{\"Name\":\"PrivacyLinkDisplayEnabled\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:24", "ExternalAccess": true, "Id": "2cb36c1c-1368-4483-9801-08d7adfc11fe", "ObjectId": "testsiem.onmicrosoft.com\\ExchangeAssistance15", "Operation": "Set-ExchangeAssistanceConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "Identity", "Value": "testsiem.onmicrosoft.com" }, { "Name": "PrivacyStatementURL", "Value": "http://go.microsoft.com/fwlink/?LinkID=259417" }, { "Name": "PrivacyLinkDisplayEnabled", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:23\",\"ExternalAccess\":true,\"Id\":\"80d8b808-c24c-4359-24cf-08d7adfc11e3\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\",\"Operation\":\"Set-RecipientEnforcementProvisioningPolicy\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\"},{\"Name\":\"PublicFolderHierarchyMailboxCountQuota\",\"Value\":\"100\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:23", "ExternalAccess": true, "Id": "80d8b808-c24c-4359-24cf-08d7adfc11e3", "ObjectId": "testsiem.onmicrosoft.com\\Recipient Quota Policy", "Operation": "Set-RecipientEnforcementProvisioningPolicy", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com\\Recipient Quota Policy" }, { "Name": "PublicFolderHierarchyMailboxCountQuota", "Value": "100" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:24\",\"ExternalAccess\":true,\"Id\":\"a9fb5fce-4ce4-43eb-f429-08d7adfc122c\",\"ObjectId\":\"testsiem.onmicrosoft.com\",\"Operation\":\"Set-TenantObjectVersion\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:24", "ExternalAccess": true, "Id": "a9fb5fce-4ce4-43eb-f429-08d7adfc122c", "ObjectId": "testsiem.onmicrosoft.com", "Operation": "Set-TenantObjectVersion", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:49\",\"ExternalAccess\":true,\"Id\":\"5f84ceaa-e6df-4ba1-1085-08d7ac0f4646\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\",\"Operation\":\"Add-MailboxPermission\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\"},{\"Name\":\"User\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management\"},{\"Name\":\"AccessRights\",\"Value\":\"FullAccess\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:49", "ExternalAccess": true, "Id": "5f84ceaa-e6df-4ba1-1085-08d7ac0f4646", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}", "Operation": "Add-MailboxPermission", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}" }, { "Name": "User", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management" }, { "Name": "AccessRights", "Value": "FullAccess" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:49\",\"ExternalAccess\":true,\"Id\":\"1c7412a6-858d-49ff-3f93-08d7ac0f45bf\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:49", "ExternalAccess": true, "Id": "1c7412a6-858d-49ff-3f93-08d7ac0f45bf", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:55\",\"ExternalAccess\":true,\"Id\":\"0caecd44-0161-44e5-0e45-08d7ac0f49d6\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Admin Audit Log Settings\",\"Operation\":\"Set-AdminAuditLogConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"},{\"Name\":\"AdminAuditLogEnabled\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:55", "ExternalAccess": true, "Id": "0caecd44-0161-44e5-0e45-08d7ac0f49d6", "ObjectId": "testsiem.onmicrosoft.com\\Admin Audit Log Settings", "Operation": "Set-AdminAuditLogConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" }, { "Name": "AdminAuditLogEnabled", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:12\",\"ExternalAccess\":true,\"Id\":\"7386959b-a0d0-459e-baf8-08d7adfc0b4b\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"OMEncryptionStore\",\"Value\":\"True\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:12", "ExternalAccess": true, "Id": "7386959b-a0d0-459e-baf8-08d7adfc0b4b", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "OMEncryptionStore", "Value": "True" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"7b5e608f-0a09-4251-8922-08d7adfc0d15\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "7b5e608f-0a09-4251-8922-08d7adfc0d15", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:03\",\"ExternalAccess\":true,\"Id\":\"96b98335-ab19-4e22-31e0-08d7ac0f2ac2\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:03", "ExternalAccess": true, "Id": "96b98335-ab19-4e22-31e0-08d7ac0f2ac2", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:21\",\"ExternalAccess\":true,\"Id\":\"a61cdc9a-89ef-402b-102c-08d7ac0f3592\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:21", "ExternalAccess": true, "Id": "a61cdc9a-89ef-402b-102c-08d7ac0f3592", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:04\",\"ExternalAccess\":true,\"Id\":\"5cd5fc38-5b48-47d6-2e47-08d7ac0f2b01\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:04", "ExternalAccess": true, "Id": "5cd5fc38-5b48-47d6-2e47-08d7ac0f2b01", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{61D4A3E5-D6B5-401C-B13A-CCAD2BA8E8E9}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:21\",\"ExternalAccess\":true,\"Id\":\"ff48ffeb-5c2a-468f-9113-08d7ac0f3512\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:21", "ExternalAccess": true, "Id": "ff48ffeb-5c2a-468f-9113-08d7ac0f3512", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"d16f181c-257c-4d40-45e1-08d7adfc0c02\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "d16f181c-257c-4d40-45e1-08d7adfc0c02", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:57\",\"ExternalAccess\":true,\"Id\":\"02c7f756-40e0-4c47-d49d-08d7ac0f26bd\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:57", "ExternalAccess": true, "Id": "02c7f756-40e0-4c47-d49d-08d7ac0f26bd", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:21\",\"ExternalAccess\":true,\"Id\":\"86a8ddaf-15d2-44b4-62d5-08d7adfc1062\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\",\"Operation\":\"Add-MailboxPermission\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}\"},{\"Name\":\"User\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management\"},{\"Name\":\"AccessRights\",\"Value\":\"FullAccess\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:21", "ExternalAccess": true, "Id": "86a8ddaf-15d2-44b4-62d5-08d7adfc1062", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}", "Operation": "Add-MailboxPermission", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/DiscoverySearchMailbox{D919BA05-46A6-415f-80AD-7E09334BB852}" }, { "Name": "User", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Discovery Management" }, { "Name": "AccessRights", "Value": "FullAccess" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:57\",\"ExternalAccess\":true,\"Id\":\"8b544cbd-f42b-4910-82ef-08d7ac0f26fc\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:57", "ExternalAccess": true, "Id": "8b544cbd-f42b-4910-82ef-08d7ac0f26fc", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{E9F19AD5-5B1D-4361-BE94-E55A6E1A6AA3}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:13\",\"ExternalAccess\":true,\"Id\":\"e6a88958-ff2a-4e9b-d681-08d7adfc0b73\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"DisplayName\",\"Value\":\"Microsoft Exchange\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"9 GB (9,663,676,416 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:13", "ExternalAccess": true, "Id": "e6a88958-ff2a-4e9b-d681-08d7adfc0b73", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "DisplayName", "Value": "Microsoft Exchange" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "9 GB (9,663,676,416 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042" }, { "Name": "ProhibitSendReceiveQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:07\",\"ExternalAccess\":true,\"Id\":\"d7134fa4-2e25-4a7d-d84d-08d7adfc0802\",\"ObjectId\":\"testsiem.onmicrosoft.com\",\"Operation\":\"Enable-AddressListPaging\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DoNotUpdateRecipients\",\"Value\":\"True\"},{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:07", "ExternalAccess": true, "Id": "d7134fa4-2e25-4a7d-d84d-08d7adfc0802", "ObjectId": "testsiem.onmicrosoft.com", "Operation": "Enable-AddressListPaging", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DoNotUpdateRecipients", "Value": "True" }, { "Name": "DomainController", "Value": "" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:14\",\"ExternalAccess\":true,\"Id\":\"ee2a5c48-f068-4672-3e34-08d7adfc0bf4\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:14", "ExternalAccess": true, "Id": "ee2a5c48-f068-4672-3e34-08d7adfc0bf4", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:32\",\"ExternalAccess\":true,\"Id\":\"060e0f74-72a7-40d1-30fa-08d7ac0f17d8\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Resource Schema\",\"Operation\":\"Install-ResourceConfig\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"Organization\",\"Value\":\"testsiem.onmicrosoft.com\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:32", "ExternalAccess": true, "Id": "060e0f74-72a7-40d1-30fa-08d7ac0f17d8", "ObjectId": "testsiem.onmicrosoft.com\\Resource Schema", "Operation": "Install-ResourceConfig", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "Organization", "Value": "testsiem.onmicrosoft.com" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:23\",\"ExternalAccess\":true,\"Id\":\"80d8b808-c24c-4359-24cf-08d7adfc11e3\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\",\"Operation\":\"Set-RecipientEnforcementProvisioningPolicy\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\"},{\"Name\":\"PublicFolderHierarchyMailboxCountQuota\",\"Value\":\"100\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:23", "ExternalAccess": true, "Id": "80d8b808-c24c-4359-24cf-08d7adfc11e3", "ObjectId": "testsiem.onmicrosoft.com\\Recipient Quota Policy", "Operation": "Set-RecipientEnforcementProvisioningPolicy", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com\\Recipient Quota Policy" }, { "Name": "PublicFolderHierarchyMailboxCountQuota", "Value": "100" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:42\",\"ExternalAccess\":true,\"Id\":\"27fdc2ec-edbd-445c-92bd-08d7ac0f1dc6\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"UMGrammar\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"MaxSendSize\",\"Value\":\"1 GB (1,073,741,824 bytes)\"},{\"Name\":\"MailRouting\",\"Value\":\"True\"},{\"Name\":\"MessageTracking\",\"Value\":\"True\"},{\"Name\":\"OMEncryption\",\"Value\":\"True\"},{\"Name\":\"OABGen\",\"Value\":\"True\"},{\"Name\":\"ClientExtensions\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}\"},{\"Name\":\"GMGen\",\"Value\":\"True\"},{\"Name\":\"SuiteServiceStorage\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:42", "ExternalAccess": true, "Id": "27fdc2ec-edbd-445c-92bd-08d7ac0f1dc6", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "Force", "Value": "True" }, { "Name": "UMGrammar", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "MaxSendSize", "Value": "1 GB (1,073,741,824 bytes)" }, { "Name": "MailRouting", "Value": "True" }, { "Name": "MessageTracking", "Value": "True" }, { "Name": "OMEncryption", "Value": "True" }, { "Name": "OABGen", "Value": "True" }, { "Name": "ClientExtensions", "Value": "True" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}" }, { "Name": "GMGen", "Value": "True" }, { "Name": "SuiteServiceStorage", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:16\",\"ExternalAccess\":true,\"Id\":\"c6db95ea-9eae-4b58-d692-08d7adfc0d98\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:16", "ExternalAccess": true, "Id": "c6db95ea-9eae-4b58-d692-08d7adfc0d98", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{505B6405-958B-45A0-BAAE-76A0D7ACAE83}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:49:52\",\"ExternalAccess\":true,\"Id\":\"c706f54e-1b00-43ed-5b06-08d7ac0f47a6\",\"ObjectId\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\",\"Operation\":\"Set-RecipientEnforcementProvisioningPolicy\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"DomainController\",\"Value\":\"\"},{\"Name\":\"IgnoreDehydratedFlag\",\"Value\":\"True\"},{\"Name\":\"Identity\",\"Value\":\"testsiem.onmicrosoft.com\\\\Recipient Quota Policy\"},{\"Name\":\"PublicFolderHierarchyMailboxCountQuota\",\"Value\":\"100\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:49:52", "ExternalAccess": true, "Id": "c706f54e-1b00-43ed-5b06-08d7ac0f47a6", "ObjectId": "testsiem.onmicrosoft.com\\Recipient Quota Policy", "Operation": "Set-RecipientEnforcementProvisioningPolicy", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "DomainController", "Value": "" }, { "Name": "IgnoreDehydratedFlag", "Value": "True" }, { "Name": "Identity", "Value": "testsiem.onmicrosoft.com\\Recipient Quota Policy" }, { "Name": "PublicFolderHierarchyMailboxCountQuota", "Value": "100" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:15\",\"ExternalAccess\":true,\"Id\":\"fcd82149-fc1c-4866-e16d-08d7adfc0cff\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:15", "ExternalAccess": true, "Id": "fcd82149-fc1c-4866-e16d-08d7adfc0cff", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{368F7EFB-D8B2-448B-A304-41EA44801476}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-07T20:48:44\",\"ExternalAccess\":true,\"Id\":\"e79cb83c-25b7-4777-57f0-08d7ac0f1f74\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"Management\",\"Value\":\"True\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"DisplayName\",\"Value\":\"Microsoft Exchange Migration\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"9 GB (9,663,676,416 bytes)\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"Migration\",\"Value\":\"True\"},{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"10 GB (10,737,418,240 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-07T20:48:44", "ExternalAccess": true, "Id": "e79cb83c-25b7-4777-57f0-08d7ac0f1f74", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "ProhibitSendReceiveQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "Management", "Value": "True" }, { "Name": "Force", "Value": "True" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "DisplayName", "Value": "Microsoft Exchange Migration" }, { "Name": "IssueWarningQuota", "Value": "9 GB (9,663,676,416 bytes)" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "Migration", "Value": "True" }, { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "ProhibitSendQuota", "Value": "10 GB (10,737,418,240 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/Migration.8f3e7716-2011-43e4-96b1-aba62d229136" }, { "Name": "Arbitration", "Value": "True" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } }, { "event": { "original": "{\"AppId\":\"\",\"ClientAppId\":\"\",\"CreationTime\":\"2020-02-10T07:37:16\",\"ExternalAccess\":true,\"Id\":\"e9e580ee-ac04-436f-9214-08d7adfc0d8b\",\"ObjectId\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\",\"Operation\":\"Set-Mailbox\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"OrganizationName\":\"testsiem.onmicrosoft.com\",\"OriginatingServer\":\"HE1PR0102MB3228 (67.43.156.13)\",\"Parameters\":[{\"Name\":\"RecoverableItemsQuota\",\"Value\":\"30 GB (32,212,254,720 bytes)\"},{\"Name\":\"Force\",\"Value\":\"True\"},{\"Name\":\"Arbitration\",\"Value\":\"True\"},{\"Name\":\"QuarantineMessageStore\",\"Value\":\"True\"},{\"Name\":\"ProhibitSendQuota\",\"Value\":\"99 GB (106,300,440,576 bytes)\"},{\"Name\":\"HiddenFromAddressListsEnabled\",\"Value\":\"True\"},{\"Name\":\"SCLDeleteEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLQuarantineEnabled\",\"Value\":\"False\"},{\"Name\":\"SCLRejectEnabled\",\"Value\":\"False\"},{\"Name\":\"UseDatabaseQuotaDefaults\",\"Value\":\"False\"},{\"Name\":\"RecoverableItemsWarningQuota\",\"Value\":\"20 GB (21,474,836,480 bytes)\"},{\"Name\":\"IssueWarningQuota\",\"Value\":\"90 GB (96,636,764,160 bytes)\"},{\"Name\":\"Identity\",\"Value\":\"EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}\"},{\"Name\":\"ProhibitSendReceiveQuota\",\"Value\":\"100 GB (107,374,182,400 bytes)\"},{\"Name\":\"SCLJunkEnabled\",\"Value\":\"False\"}],\"RecordType\":\"1\",\"ResultStatus\":\"True\",\"UserId\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserKey\":\"NT AUTHORITY\\\\SYSTEM (Microsoft.Exchange.ServiceHost)\",\"UserType\":\"3\",\"Version\":\"1\",\"Workload\":\"Exchange\"}" }, "o365audit": { "AppId": "", "ClientAppId": "", "CreationTime": "2020-02-10T07:37:16", "ExternalAccess": true, "Id": "e9e580ee-ac04-436f-9214-08d7adfc0d8b", "ObjectId": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}", "Operation": "Set-Mailbox", "OrganizationId": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd", "OrganizationName": "testsiem.onmicrosoft.com", "OriginatingServer": "HE1PR0102MB3228 (67.43.156.13)", "Parameters": [ { "Name": "RecoverableItemsQuota", "Value": "30 GB (32,212,254,720 bytes)" }, { "Name": "Force", "Value": "True" }, { "Name": "Arbitration", "Value": "True" }, { "Name": "QuarantineMessageStore", "Value": "True" }, { "Name": "ProhibitSendQuota", "Value": "99 GB (106,300,440,576 bytes)" }, { "Name": "HiddenFromAddressListsEnabled", "Value": "True" }, { "Name": "SCLDeleteEnabled", "Value": "False" }, { "Name": "SCLQuarantineEnabled", "Value": "False" }, { "Name": "SCLRejectEnabled", "Value": "False" }, { "Name": "UseDatabaseQuotaDefaults", "Value": "False" }, { "Name": "RecoverableItemsWarningQuota", "Value": "20 GB (21,474,836,480 bytes)" }, { "Name": "IssueWarningQuota", "Value": "90 GB (96,636,764,160 bytes)" }, { "Name": "Identity", "Value": "EURPR01A002.prod.outlook.com/Microsoft Exchange Hosted Organizations/testsiem.onmicrosoft.com/QuarantineOrgShard{D5FD6316-0A84-416F-8512-3E97EBAF9B1D}" }, { "Name": "ProhibitSendReceiveQuota", "Value": "100 GB (107,374,182,400 bytes)" }, { "Name": "SCLJunkEnabled", "Value": "False" } ], "RecordType": "1", "ResultStatus": "True", "UserId": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserKey": "NT AUTHORITY\\SYSTEM (Microsoft.Exchange.ServiceHost)", "UserType": "3", "Version": "1", "Workload": "Exchange" } } ] }