Too Many Recipients
Query
//Identify emails sent to more than 100 recipients
EmailEvents
| where array_length(split(RecipientEmailAddress, ",")) > 100
| project Timestamp, NetworkMessageId, SenderMailFromAddress, RecipientEmailAddress, SubjectExplanation
This query identifies emails that were sent to more than 100 recipients. It retrieves the timestamp, network message ID, sender's email address, recipient's email address, and subject of these emails.
Details
Rod Trent
Released: November 13, 2023
Tables
EmailEvents
Keywords
EmailEventsRecipientEmailAddress
Operators
wherearray_lengthsplit>project