1 Reply Latest reply on Jun 16, 2015 11:05 AM by sulikoakhvlediani

    How enable and retrieve Exchange audit events

    sulikoakhvlediani

      Hello, I want to enable Microsoft Exchange 2012 Audit Events (unauthorized access: Unauthorized person assigns mailbox,  forwarded mail and other type of changes. Also when there is a several connections on the same mailbox at the same time).

      As I know there is other vendors application called LOGbinder which can retrive these logs from Exchange, and this app can be added as Data Source to SIEM.

      But I want do it without this app.

      Questions:

      1. How enable this type of audit on Exchange
      2. How send these logs (maybe with McAfee Collector) to Receiver?

      Thanks.