* any Outlook Web Access Exchange Web Services ActiveSync *

This dashboard shows where users are logging on to the system from when they are logging in from an external location.

Note that methods that do not record an IP address (POP3, IMAP4, and Blackberry Enterprise Server) are not listed here.

eventtype=client-iis-logs WebApplication="$selectedApp$" cs_username="$username$" |eval isinternal=`is-internal-ip(c_ip)`|where isinternal==0 |iplocation c_ip |eval WebApplication=lower(WebApplication) |geostats dc(cs_username) by WebApplication