Update ESI-ExchangeAdminAuditLogEvents.json

Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeAdminAuditLogEvents.json

@@ -546,7 +546,7 @@
                                                                                         },
                                                                                         {
                                                                                             "title": "C. Modify the created DCR, Type Custom log",
-                                                                                            "description": "1.  From the Azure Portal, navigate to [Azure Data collection rules](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules).\n2. Select the previously created DCR, like **DCR-Option6-MessageTrackingLogs**.\n3. In the **Resources** tab, enter you Exchange Servers.\n4. In **Data Sources**, add a Data Source type 'Custom Text logs' and enter 'C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking\\*.log' in file pattern, 'MessageTrackingLog_CL' in Table Name.\n6.in Transform field, enter the following KQL request :\n*source\n| extend TimeGenerated = todatetime(['date-time'])\n| extend\n    clientHostname = ['client-hostname'],\n    clientIP = ['client-ip'],\n    connectorId = ['connector-id'],\n    customData = ['custom-data'],\n    eventId = ['event-id'],\n    internalMessageId = ['internal-message-id'],\n    logId = ['log-id'],\n    messageId = ['message-id'],\n    messageInfo = ['message-info'],\n    messageSubject = ['message-subject'],\n    networkMessageId = ['network-message-id'],\n    originalClientIp =  ['original-client-ip'],\n    originalServerIp = ['original-server-ip'],\n    recipientAddress= ['recipient-address'],\n    recipientCount= ['recipient-count'],\n    recipientStatus= ['recipient-status'],\n    relatedRecipientAddress= ['related-recipient-address'],\n    returnPath= ['return-path'],\n    senderAddress= ['sender-address'],\n    senderHostname= ['server-hostname'],\n    serverIp= ['server-ip'],\n    sourceContext= ['source-context'],\n    schemaVersion=['schema-version'],\n    messageTrackingTenantId = ['tenant-id'],\n    totalBytes = ['total-bytes'],\n    transportTrafficType = ['transport-traffic-type']\n| project-away\n    ['client-ip'],\n    ['client-hostname'],\n    ['connector-id'],\n    ['custom-data'],\n    ['date-time'],\n    ['event-id'],\n    ['internal-message-id'],\n    ['log-id'],\n    ['message-id'],\n    ['message-info'],\n    ['message-subject'],\n    ['network-message-id'],\n    ['original-client-ip'],\n    ['original-server-ip'],\n    ['recipient-address'],\n    ['recipient-count'],\n    ['recipient-status'],\n    ['related-recipient-address'],\n    ['return-path'],\n    ['sender-address'],\n    ['server-hostname'],\n    ['server-ip'],\n    ['source-context'],\n    ['schema-version'],\n    ['tenant-id'],\n    ['total-bytes'],\n    ['transport-traffic-type']* \n7. Click on 'Add data source'."
+                                                                                            "description": "1.  From the Azure Portal, navigate to [Azure Data collection rules](https://portal.azure.com/#view/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/~/dataCollectionRules).\n2. Select the previously created DCR, like **DCR-Option6-MessageTrackingLogs**.\n3. In the **Resources** tab, enter you Exchange Servers.\n4. In **Data Sources**, add a Data Source type 'Custom Text logs' and enter 'C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking\\*.log' in file pattern, 'MessageTrackingLog_CL' in Table Name.\n6.in Transform field, enter the following KQL request :\n*source | extend TimeGenerated = todatetime(['date-time']) | extend clientHostname = ['client-hostname'], clientIP = ['client-ip'], connectorId = ['connector-id'], customData = ['custom-data'], eventId = ['event-id'], internalMessageId = ['internal-message-id'], logId = ['log-id'], messageId = ['message-id'], messageInfo = ['message-info'], messageSubject = ['message-subject'], networkMessageId = ['network-message-id'], originalClientIp = ['original-client-ip'], originalServerIp = ['original-server-ip'], recipientAddress= ['recipient-address'], recipientCount= ['recipient-count'], recipientStatus= ['recipient-status'], relatedRecipientAddress= ['related-recipient-address'], returnPath= ['return-path'], senderAddress= ['sender-address'], senderHostname= ['server-hostname'], serverIp= ['server-ip'], sourceContext= ['source-context'], schemaVersion=['schema-version'], messageTrackingTenantId = ['tenant-id'], totalBytes = ['total-bytes'], transportTrafficType = ['transport-traffic-type'] | project-away ['client-ip'], ['client-hostname'], ['connector-id'], ['custom-data'], ['date-time'], ['event-id'], ['internal-message-id'], ['log-id'], ['message-id'], ['message-info'], ['message-subject'], ['network-message-id'], ['original-client-ip'], ['original-server-ip'], ['recipient-address'], ['recipient-count'], ['recipient-status'], ['related-recipient-address'],\n  ['return-path'],\n  ['sender-address'],\n  ['server-hostname'],\n  ['server-ip'], ['source-context'], ['schema-version'], ['tenant-id'], ['total-bytes'], ['transport-traffic-type']* \n7. Click on 'Add data source'."
                                                                                         }
                                                                                     ]
                                                                                 },