On my exchange server, in the MSExchange Management log, I see an eventID 1 with a MSExchange CmdletLogs source,for: Cmdlet Add-MailboxPermission. This event is for the when an administrator is granting Full access to a user's mailbox.
I do not see these logs being syslog to our SIEM. There are other logs being sent over, but not from the Admin Audit Log.
What in my configuration am I missing that these logs are not being syslogged? Thank you.
|