{"CreationTime": "2024-03-25T21:56:29", "Id": "95428ddb-9aa0-4bcf-84f4-08dc4d166d4c", "Operation": "AlertTriggered", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 40, "ResultStatus": "Succeeded", "UserKey": "SecurityComplianceAlerts", "UserType": 4, "Version": 1, "Workload": "SecurityComplianceCenter", "ObjectId": "95adeea5-ede1-136f-5200-08dc4d1637c4", "UserId": "SecurityComplianceAlerts", "AlertId": "95adeea5-ede1-136f-5200-08dc4d1637c4", "AlertLinks": [{"AlertLinkHref": ""}], "AlertType": "System", "Category": "ThreatManagement", "Comments": "New alert", "Data": "{\"f3u\":\"user15@splunkresearch.com\",\"ts\":\"2024-03-25T21:54:00.0000000Z\",\"te\":\"2024-03-25T21:55:00.0000000Z\",\"op\":\"MailRedirect\",\"wl\":\"Exchange\",\"tid\":\"75243ab2-44f8-435c-a7a6-b479385df6d4\",\"tdc\":\"1\",\"reid\":\"136169be-3964-4b4c-2087-08dc4d1621a2\",\"wsrt\":\"2024-03-25T21:56:18\",\"mdt\":\"Audit\",\"rid\":\"0c04b79b-9148-4950-af22-2657dd53a92c\",\"cid\":\"d59a8fd4-1272-41ee-9408-86f7bcf72479\",\"ad\":\"This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5\",\"lon\":\"MailRedirect\",\"an\":\"Creation of forwarding/redirect rule\",\"sev\":\"Informational\"}", "Name": "Creation of forwarding/redirect rule", "PolicyId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Severity": "Informational", "Source": "Office 365 Security & Compliance", "Status": "Active"}
{"CreationTime": "2024-03-25T21:56:29", "Id": "bac7174a-19a9-4374-55fb-08dc4d166d45", "Operation": "AlertEntityGenerated", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 40, "ResultStatus": "Succeeded", "UserKey": "SecurityComplianceAlerts", "UserType": 4, "Version": 1, "Workload": "SecurityComplianceCenter", "ObjectId": "user15@splunkresearch.com", "UserId": "SecurityComplianceAlerts", "AlertEntityId": "user15@splunkresearch.com", "AlertId": "95adeea5-ede1-136f-5200-08dc4d1637c4", "AlertLinks": [{"AlertLinkHref": ""}], "AlertType": "System", "Category": "ThreatManagement", "Comments": "New alert", "Data": "{\"etype\":\"User\",\"eid\":\"user15@splunkresearch.com\",\"tid\":\"75243ab2-44f8-435c-a7a6-b479385df6d4\",\"ts\":\"2024-03-25T21:54:22.0000000Z\",\"te\":\"2024-03-25T21:54:22.0000000Z\",\"op\":\"MailRedirect\",\"tdc\":\"1\",\"suid\":\"user15@splunkresearch.com\",\"ut\":\"Regular\",\"ssic\":\"0\",\"lon\":\"MailRedirect\"}", "EntityType": "User", "Name": "Creation of forwarding/redirect rule", "PolicyId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Severity": "Informational", "Source": "Office 365 Security & Compliance", "Status": "Active"}
{"CreationTime": "2024-03-25T21:54:15", "Id": "bf8399ed-18d0-45fe-5cb1-08dc4d161d27", "Operation": "AlertTriggered", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 40, "ResultStatus": "Succeeded", "UserKey": "SecurityComplianceAlerts", "UserType": 4, "Version": 1, "Workload": "SecurityComplianceCenter", "ObjectId": "95adeea5-ede1-136f-ae00-08dc4d156130", "UserId": "SecurityComplianceAlerts", "AlertId": "95adeea5-ede1-136f-ae00-08dc4d156130", "AlertLinks": [{"AlertLinkHref": ""}], "AlertType": "System", "Category": "ThreatManagement", "Comments": "New alert", "Data": "{\"f3u\":\"user15@splunkresearch.com\",\"ts\":\"2024-03-25T21:48:00.0000000Z\",\"te\":\"2024-03-25T21:49:00.0000000Z\",\"op\":\"MailRedirect\",\"wl\":\"Exchange\",\"tid\":\"75243ab2-44f8-435c-a7a6-b479385df6d4\",\"tdc\":\"1\",\"reid\":\"884b4cf9-3329-47aa-7241-08dc4d1556b2\",\"wsrt\":\"2024-03-25T21:53:15\",\"mdt\":\"Audit\",\"rid\":\"0c04b79b-9148-4950-af22-2657dd53a92c\",\"cid\":\"d59a8fd4-1272-41ee-9408-86f7bcf72479\",\"ad\":\"This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5\",\"lon\":\"MailRedirect\",\"an\":\"Creation of forwarding/redirect rule\",\"sev\":\"Informational\"}", "Name": "Creation of forwarding/redirect rule", "PolicyId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Severity": "Informational", "Source": "Office 365 Security & Compliance", "Status": "Active"}
{"CreationTime": "2024-03-25T21:54:15", "Id": "0d0eee3a-7bbe-005f-54eb-08dc4d161d48", "Operation": "AlertUpdated", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 40, "ResultStatus": "Succeeded", "UserKey": "SecurityComplianceAlerts", "UserType": 4, "Version": 1, "Workload": "SecurityComplianceCenter", "ObjectId": "95adeea5-ede1-136f-ae00-08dc4d156130", "UserId": "SecurityComplianceAlerts", "AlertId": "95adeea5-ede1-136f-ae00-08dc4d156130", "AlertLinks": [{"AlertLinkHref": ""}], "AlertType": "System", "Category": "ThreatManagement", "Comments": "New alert", "Data": "{\"f3u\":\"user15@splunkresearch.com\",\"ts\":\"2024-03-25T21:48:00.0000000Z\",\"te\":\"2024-03-25T21:49:00.0000000Z\",\"op\":\"MailRedirect\",\"wl\":\"Exchange\",\"tid\":\"75243ab2-44f8-435c-a7a6-b479385df6d4\",\"tdc\":\"1\",\"reid\":\"884b4cf9-3329-47aa-7241-08dc4d1556b2\",\"wsrt\":\"2024-03-25T21:53:15\",\"mdt\":\"Audit\",\"rid\":\"0c04b79b-9148-4950-af22-2657dd53a92c\",\"cid\":\"d59a8fd4-1272-41ee-9408-86f7bcf72479\",\"ad\":\"This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5\",\"lon\":\"MailRedirect\",\"an\":\"Creation of forwarding/redirect rule\",\"sev\":\"Informational\"}", "Name": "Creation of forwarding/redirect rule", "PolicyId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Severity": "Informational", "Source": "Office 365 Security & Compliance", "Status": "Active"}
{"CreationTime": "2024-03-25T21:54:15", "Id": "08797038-477d-4542-b79a-08dc4d161d21", "Operation": "AlertEntityGenerated", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 40, "ResultStatus": "Succeeded", "UserKey": "SecurityComplianceAlerts", "UserType": 4, "Version": 1, "Workload": "SecurityComplianceCenter", "ObjectId": "user15@splunkresearch.com", "UserId": "SecurityComplianceAlerts", "AlertEntityId": "user15@splunkresearch.com", "AlertId": "95adeea5-ede1-136f-ae00-08dc4d156130", "AlertLinks": [{"AlertLinkHref": ""}], "AlertType": "System", "Category": "ThreatManagement", "Comments": "New alert", "Data": "{\"etype\":\"User\",\"eid\":\"user15@splunkresearch.com\",\"tid\":\"75243ab2-44f8-435c-a7a6-b479385df6d4\",\"ts\":\"2024-03-25T21:48:42.0000000Z\",\"te\":\"2024-03-25T21:48:42.0000000Z\",\"op\":\"MailRedirect\",\"tdc\":\"1\",\"suid\":\"user15@splunkresearch.com\",\"ut\":\"Regular\",\"ssic\":\"0\",\"lon\":\"MailRedirect\"}", "EntityType": "User", "Name": "Creation of forwarding/redirect rule", "PolicyId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Severity": "Informational", "Source": "Office 365 Security & Compliance", "Status": "Active"}
{"CreationTime": "2024-03-25T20:59:28", "Id": "faa5da76-b84b-4708-784d-08dc4d0e75c3", "Operation": "AlertEntityGenerated", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 40, "ResultStatus": "Succeeded", "UserKey": "SecurityComplianceAlerts", "UserType": 4, "Version": 1, "Workload": "SecurityComplianceCenter", "ObjectId": "user15@splunkresearch.com", "UserId": "SecurityComplianceAlerts", "AlertEntityId": "user15@splunkresearch.com", "AlertId": "95adeea5-ede1-136f-7600-08dc4d0e1d86", "AlertLinks": [{"AlertLinkHref": ""}], "AlertType": "System", "Category": "ThreatManagement", "Comments": "New alert", "Data": "{\"etype\":\"User\",\"eid\":\"user15@splunkresearch.com\",\"tid\":\"75243ab2-44f8-435c-a7a6-b479385df6d4\",\"ts\":\"2024-03-25T20:56:12.0000000Z\",\"te\":\"2024-03-25T20:56:12.0000000Z\",\"op\":\"MailRedirect\",\"tdc\":\"1\",\"suid\":\"user15@splunkresearch.com\",\"ut\":\"Admin\",\"ssic\":\"0\",\"lon\":\"MailRedirect\"}", "EntityType": "User", "Name": "Creation of forwarding/redirect rule", "PolicyId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Severity": "Informational", "Source": "Office 365 Security & Compliance", "Status": "Active"}
{"CreationTime": "2024-03-25T20:59:28", "Id": "19c93367-ebf4-4106-dacf-08dc4d0e75c7", "Operation": "AlertTriggered", "OrganizationId": "75243ab2-44f8-435c-a7a6-b479385df6d4", "RecordType": 40, "ResultStatus": "Succeeded", "UserKey": "SecurityComplianceAlerts", "UserType": 4, "Version": 1, "Workload": "SecurityComplianceCenter", "ObjectId": "95adeea5-ede1-136f-7600-08dc4d0e1d86", "UserId": "SecurityComplianceAlerts", "AlertId": "95adeea5-ede1-136f-7600-08dc4d0e1d86", "AlertLinks": [{"AlertLinkHref": ""}], "AlertType": "System", "Category": "ThreatManagement", "Comments": "New alert", "Data": "{\"f3u\":\"user15@splunkresearch.com\",\"ts\":\"2024-03-25T20:56:00.0000000Z\",\"te\":\"2024-03-25T20:57:00.0000000Z\",\"op\":\"MailRedirect\",\"wl\":\"Exchange\",\"tid\":\"75243ab2-44f8-435c-a7a6-b479385df6d4\",\"tdc\":\"1\",\"reid\":\"36b38f50-a212-4edf-9048-08dc4d0e013e\",\"wsrt\":\"2024-03-25T20:58:42\",\"mdt\":\"Audit\",\"rid\":\"0c04b79b-9148-4950-af22-2657dd53a92c\",\"cid\":\"d59a8fd4-1272-41ee-9408-86f7bcf72479\",\"ad\":\"This alert is triggered when someone in your organization sets up auto-forwarding, email forwarding, redirect rule or a mail flow rule -V1.0.0.5\",\"lon\":\"MailRedirect\",\"an\":\"Creation of forwarding/redirect rule\",\"sev\":\"Informational\"}", "Name": "Creation of forwarding/redirect rule", "PolicyId": "d59a8fd4-1272-41ee-9408-86f7bcf72479", "Severity": "Informational", "Source": "Office 365 Security & Compliance", "Status": "Active"}