m365:unified MailItemsAccessed
MailItemsAccessed
- Log source
- Microsoft 365 Unified Audit Log
- Host type
- Microsoft 365
- Tier, host type
- Minimum
- Techniques
- 2
- Rules depending on it
- Splunk 3, Elastic 3, Microsoft Sentinel 1
Why this tier
CISA/ASD
By role
| Role | Tier | Basis |
|---|---|---|
| Microsoft 365 tenant | Minimum | CISA/ASD |
Techniques it helps detect
Rules that depend on it
Splunk 3
Elastic 3
Microsoft Sentinel 1
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| CISA: Expanded Microsoft 365 audit operationsMicrosoft Expanded Cloud Logs Implementation Playbook (Jan 2025) | Names this event | Exchange: mail item access by mail protocols and clients |