diff --git a/Functions/OfficeMailForwardingParser.txt b/Functions/OfficeMailForwardingParser.txt index 45d7de8a84..118470ea4a 100644 --- a/Functions/OfficeMailForwardingParser.txt +++ b/Functions/OfficeMailForwardingParser.txt @@ -18,10 +18,10 @@ // Usage Instruction : // Either run this parser as a stand alone query within Azure Sentinel or save it as a KQL function for later use. Further details on // functions can be found here: https://techcommunity.microsoft.com/t5/Azure-Sentinel/Using-KQL-functions-to-speed-up-analysis-in-Azure-Sentinel/ba-p/712381 +// If running as a stand alone qeury consider adding customised time range to the query at run time. // // OfficeActivity - | where TimeGenerated >= ago(30d) | where Operation == 'New-InboxRule' | extend details = parse_json(Parameters) | where details contains 'ForwardTo' or details contains 'RedirectTo'