Yes, a mailbox is needed. LOGbinder requests the audit data from Exchange. Exchange processes the request and delivers the results to a mailbox, normally and preferably the mailbox of the service account running LOGbinder. Currently On Prem is the only supported environment for LOGbinder for Exchange. We do not currently support Exchange Online.
Question, when you say hybrid what exact setup are you referring to? I ask because I’ve heard different people use hybrid to explain varying types of configurations. I just want to make sure I understand you correctly.