UBA : Failed to Set Mailbox Audit Logging Bypass

The QRadar® User Behavior Analytics (UBA) app supports use cases based on rules for certain behavioral anomalies.

UBA : Failed to Set Mailbox Audit Logging Bypass

Enabled by default

False

Default senseValue

10

Description

Detects when a user failed to correctly set mailbox audit logging bypass.

Support rules

BB:UBA : Common Event Filters

Log source types

Microsoft Office 365 (EventID: Set-MailboxAuditBypassAssociation-false)