[BUG] O365 Mailbox Inbox Folder Shared with All Users. Field "object" doesn't exist.

[atgithub11]

Correlation search, O365 Mailbox Inbox Folder Shared with All Users, is currently using a field called "object", as object=Inbox. But I do not see this field being sent as part of O365 exchange data. Instead, I see a field called Item.ParentFolder.Name with values such as Inbox, Calender, Contacts etc.

Should "object=Inbox" be replaced with "Item.ParentFolder.Name=Inbox" for this correlation search?

App Version:

• ESCU: 4.18.0

[josehelps]

@atgithub11 this might be due to how the data for o365 is being collected in your environment. I believe for this detection we expect the user to be leveraging https://splunkbase.splunk.com/app/4055 let me know if this is the case?