MSExchange Unified Messaging

Event	Title	Channel	Sample	Rule
1411	Event ID 1411	Application	Y	N
1629	Event ID 1629	Application	Y	N
1630	Event ID 1630	Application	Y	N
1641	Event ID 1641	Application	Y	N
1642	Event ID 1642	Application	Y	N

Event ID 1411

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchange Unified Messaging",
    "guid": "",
    "event_source_name": "",
    "event_id": 1411,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:28:40.979656+00:00",
    "event_record_id": 4915,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "",
    "Binary": ""
  },
  "message": ""
}

Event ID 1629

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchange Unified Messaging",
    "guid": "",
    "event_source_name": "",
    "event_id": 1629,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:30:21.385900+00:00",
    "event_record_id": 4960,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>DistributionList</string>\n<string>Enterprise</string>\n<string>a7321e20-f40b-4eca-9ab5-3d5d94068bbe</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 1630

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchange Unified Messaging",
    "guid": "",
    "event_source_name": "",
    "event_id": 1630,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:30:21.401573+00:00",
    "event_record_id": 4961,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>DistributionList</string>\n<string>Enterprise</string>\n<string>a7321e20-f40b-4eca-9ab5-3d5d94068bbe</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 1641

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchange Unified Messaging",
    "guid": "",
    "event_source_name": "",
    "event_id": 1641,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:30:21.323416+00:00",
    "event_record_id": 4959,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Enterprise</string>\n<string>9877097d-0ea4-4319-b37e-17019e04369d</string>\n<string>a7321e20-f40b-4eca-9ab5-3d5d94068bbe</string>\n",
    "Binary": ""
  },
  "message": ""
}

Event ID 1642

Channel: Application
Level: 4

Fields #

Name	Description
`Data_0`
`Binary`

Example Event #

{
  "system": {
    "provider": "MSExchange Unified Messaging",
    "guid": "",
    "event_source_name": "",
    "event_id": 1642,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-05-09 21:30:23.620279+00:00",
    "event_record_id": 4965,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Application",
    "computer": "EX-DC01-2022.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "<string>Enterprise</string>\n<string>9877097d-0ea4-4319-b37e-17019e04369d</string>\n<string>a7321e20-f40b-4eca-9ab5-3d5d94068bbe</string>\n",
    "Binary": ""
  },
  "message": ""
}