Query Details
Too Many Recipients
Query
//Identify emails sent to more than 100 recipients EmailEvents | where array_length(split(RecipientEmailAddress, ",")) > 100 | project Timestamp, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, Subject
Explanation
This query identifies emails that were sent to more than 100 recipients. It retrieves the timestamp, network message ID, sender's email address, recipient's email address, and subject of these emails.
Details
Rod Trent
Released: November 13, 2023
Tables
EmailEvents
Keywords
EmailEvents,RecipientEmailAddress
Operators
wherearray_lengthsplit>project