Sure, here you have
{
"timestamp": "2024-02-05T09:32:31.000Z",
"source_user": "User 1111",
"service": "o365",
"action": "UpdateInboxRules",
"source_account": "account1@mydomain.com",
"source_json": {
"CreationTime": "2024-02-05T09:32:31",
"Id": "XXXXXXXXXXXXXXXXXXXXX",
"Operation": "UpdateInboxRules",
"OrganizationId": "XXXXXXXXXXXXXXXXXXXXXXXX",
"RecordType": 2,
"ResultStatus": "Succeeded",
"UserKey": "XXXXXXXXXXXXXXXX",
"UserType": 0,
"Version": 1,
"Workload": "Exchange",
"ClientIP": "11.22.33.44",
"UserId": "account1@mydomain.com",
"ClientIPAddress": "11.22.33.44",
"ClientInfoString": "Client=MSExchangeRPC",
"ClientProcessName": "OUTLOOK.EXE",
"ClientRequestId": "{XXXXXXXXXXXXXXXXXXXXXXX}",
"ClientVersion": "XXXXXXXX",
"ExternalAccess": false,
"InternalLogonType": 0,
"LogonType": 2,
"LogonUserSid": "XXXXXXXXXXXXXXXXXXXXX",
"MailboxGuid": "XXXXXXXXXXXXX",
"MailboxOwnerMasterAccountSid": "XXXXXXXXXXXXX",
"MailboxOwnerSid": "XXXXXXXXXXXXX",
"MailboxOwnerUPN": "inbox@mydomain.com",
"OperationProperties": [
{
"Name": "RuleOperation",
"Value": "AddMailboxRule"
},
{
"Name": "RuleId",
"Value": "0"
},
{
"Name": "RuleState",
"Value": "0"
},
{
"Name": "RuleCondition",
"Value": "{(&((SubString IgnoreCase(SubjectProperty)=XXXXXXXXXXXXX)(|((SubString IgnoreCase(TextBody)=XXXXXXXXXXXXX)(SubString IgnoreCase(TextBody)=XXXXXXXXXXXXX)(SubString IgnoreCase(TextBody)=XXXXXXXXXXXXX)))))}"
},
{
"Name": "RuleName",
"Value": "RULE 1"
},
{
"Name": "RuleProvider",
"Value": "RuleOrganizer"
},
{
"Name": "RuleActions",
"Value": "[{"ActionType":"Forward","Recipients":["account2@mydomain.com"],"ForwardFlags":"None"}]"
}
],
"OrganizationName": "mydomain.onmicrosoft.com",
"OriginatingServer": "XXXXXXXXXXXXX (X.X.X.X)
\n",
"SessionId": "XXXXXXXXXXXXX",
"Item": {
"Id": "XXXXXXXXXXXXX+XXXXXXXXXXXXX",
"ParentFolder": {
"Id": "XXXXXXXXXXXXX+XXXXXXXXXXXXX",
"Name": "Bandeja de entrada",
"Path": "\Bandeja de entrada"
}
}
},
"r7_context": {
"source_user": {
"type": "user",
"rrn": "rrn:uba:XXXXXXXXXXXX",
"name": "XXXXXXXXXXXXX"
},
"source_account": {
"type": "account",
"rrn": "rrn:uba:XXXXXXXXXXXX",
"name": "account1@mydomain.com"
}
}
}