Administrator Audit - Microsoft Exchange

Host * host=" " Administrator * User=" " Command * Cmdlet=" " Parameter * Param=" "

eventtype=msexchange-admin-audit $host$ $user$ $cmdlet$ $param$ |dedup Identity |eval dt=strftime(_time,"%c") |eval Error=split(Error,"\\n") |eval Timestamp=dt |eval Server=host |eval Parameters=CmdletParam |table Timestamp,Server,User,Cmdlet,Parameters,Success,Error 25truetrue