Go Up
You are here: AdministrationMonitored Object Types, Actions, and AttributesMailbox Access

Actions Captured When Monitoring Mailbox Access

Review a full list of actions captured when monitoring mailbox access with Netwrix Auditor:

Item Action Audited How this change is reported by the product

Emails and Folders

New email

Yes

The message was created in \Drafts folder with subject <...>

A user with Send as or Send on behalf permissions tried to send an email

Yes

Message located in Root with subject <...> was queued for delivery to IPM.Message.

Delete email

Yes

Message with subject <...> was moved from folder \Drafts to folder \Deleted Items.

Move email to another folder

Yes

Message with subject <...> was moved from folder <...> to folder <...>.

Create rules for emails

No

Email read attempt

No

New folder

No

Open folder

Yes

The folder <...> was opened.

Delete folder

Yes

 

Folder <...> was moved from folder <...> to folder \Deleted Items.

Empty folder

Yes

The folder <...> was opened.

Edit folder permissions

No

Calendar

New event

Yes

Message was created in \Calendar with subject <...>.

Event read attempt

No

Edit event

Yes

Message located in \Calendar with subject <...> was modified.

Delete event

Yes

Message with subject <...> was moved from folder \Calendar to folder \Deleted Items.

People

New contact

Yes

Message was created in \Contacts\Recipient Cache with subject <contact name>.

Contact read attempt

Yes

Folder \Contacts\Recipient Cache was opened.

Edit contact

No

Delete contact

Yes

Message with subject <...> was moved from folder \Contacts to folder \Deleted Items.

Tasks

New task

Yes

Message was created in \Tasks with subject <...>.

Task read attempt

No

Edit task

Yes

Message located in \Tasks with subject <...> was modified.

Delete task

Yes

Message with subject <...> was moved from folder \Tasks to folder \Deleted Items.

Go Up