Trace Exchange Messages with Python

You can ingest security alarm data, such as candidate phishing email messages, using the sw_microsoft_exchange plugin. The Exchange plugin targets the Exchange EWS APIs via the Python exchangelib.

The Exchange plugin currently does not offer message tracing. Yet, you may want to know the answer to a question like, "How many people in an organization have received a known malicious email message?" This topic explains how you can discover the answer.

To trace Exchange messages with Python:

Install the Python package pypsrp.
Create a Python task with script similar to this:

For more information, contact your Swimlane Professional Services representative.

Powershell users can accomplish message tracing objectives with the Exchange Online PowerShell V2 module and/or the Get-MessageTrace cmdlet.