O365_Exchange_Add-MailboxPermission

ID: 100382

Description:

Add-MailboxPermission on an Exchange Mailbox - KLK

Repository: Fluency Group: Office365 Type: event

Default Status:

Enabled

Selector:

Query:

Filters:

Standard:

Additional JSON:

function json_doc_filter (doc)
   for i,v in ipairs(doc['@fields'].Parameters)
   do
      
      print(v.Name .. ": " .. v.Value)
      if v.Name == "AccessRights" and v.Value == "FullAccess" then
         return true
      end
   end
   return false
end
return json_doc_filter

Behavior Rule:

Risks:

Attributes:

Correlation Rules:

First Occurrence:

Aggregation:

History:

This page was automatically created/formatted on Wed, 2022 May 4 21:43:53 EDT, from rule_dump.json (4d88bffdfb1cea26b3985f2193033606)