Splunking for a rogue exchange admin

Recently I was speaking with a customer who was concerned that one of the Windows admins was reading the email of regular users. Thought I’d share this tidbit as a simple example of the power of search. In this case, we didn’t even have to go to other data sources other than the relevant event [...]