MSExchangeFrontEndTransport
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1022 | Event ID 1022 | Application | Y | N |
| 5044 | Event ID 5044 | Application | Y | N |
| 7009 | Event ID 7009 | Application | Y | N |
| 16022 | Event ID 16022 | Application | Y | N |
| 16028 | Event ID 16028 | Application | Y | N |
Event ID 1022
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "MSExchangeFrontEndTransport",
"guid": "",
"event_source_name": "",
"event_id": 1022,
"version": 0,
"level": 3,
"task": 1,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 21:28:45.135950+00:00",
"event_record_id": 4919,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "EX-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "<string>Client Frontend EX-DC01-2022</string>\n<string>5000</string>\n",
"Binary": ""
},
"message": ""
}
Event ID 5044
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "MSExchangeFrontEndTransport",
"guid": "",
"event_source_name": "",
"event_id": 5044,
"version": 0,
"level": 4,
"task": 4,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 21:28:28.776560+00:00",
"event_record_id": 4907,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "EX-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "<string>First read</string>\n",
"Binary": ""
},
"message": ""
}
Event ID 7009
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "MSExchangeFrontEndTransport",
"guid": "",
"event_source_name": "",
"event_id": 7009,
"version": 0,
"level": 4,
"task": 6,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 21:28:28.917156+00:00",
"event_record_id": 4908,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "EX-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "<string>FrontendTransport</string>\n<string>Active</string>\n",
"Binary": ""
},
"message": ""
}
Event ID 16022
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "MSExchangeFrontEndTransport",
"guid": "",
"event_source_name": "",
"event_id": 16022,
"version": 0,
"level": 4,
"task": 16,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 21:28:28.479719+00:00",
"event_record_id": 4899,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "EX-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "<string>Microsoft.Exchange.Transport.TransportServerConfiguration</string>\n",
"Binary": ""
},
"message": ""
}
Event ID 16028
#Fields #
| Name | Description |
|---|---|
Data_0 | |
Binary |
Example Event #
{
"system": {
"provider": "MSExchangeFrontEndTransport",
"guid": "",
"event_source_name": "",
"event_id": 16028,
"version": 0,
"level": 4,
"task": 16,
"opcode": 0,
"keywords": 36028797018963968,
"time_created": "2026-05-09 21:16:16.010950+00:00",
"event_record_id": 4766,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 0,
"thread_id": 0
},
"channel": "Application",
"computer": "EX-DC01-2022.ludus.domain",
"security": {
"user_id": ""
}
},
"event_data": {
"Data_0": "<string>System.Collections.Generic.IList`1[Microsoft.Exchange.Transport.Agent.InterceptorAgent.InterceptorAgentRule]</string>\n<string></string>\n<string></string>\n",
"Binary": ""
},
"message": ""
}