Appendix A: Mailbox Activity Events Matrix
Here is a summary of the mailbox access events supported by Cygna Auditor for Exchange for various versions of Microsoft Exchange Server, depending on the mail client and configuration type being used.
Exchange 2010
| Event Name | Outlook (Cached Mode) | Outlook (Non-Cached Mode) | Outlook Web Access |
|---|---|---|---|
| Read folder | Y | Y | Y |
| Recycle item | Y | Y | Y |
| Delete item | Y | Y | Y |
| Create item | Y | Y | Y |
| Update item | Y | Y | Y |
| Move item | Y | Y | Y |
| Copy item | Logs as Create | Logs as Create | Y |
| Rename folder | Y | Y | Y |
| Send message | Y | Y | Y |
| Create folder | Y | Y | Y |
| Mark read | Y | Y | Y |
| Mark unread | Y | Y | Y |
| Read item | Y | Y | Y |
| Delete folder | Y | Y | Y |
| Recycle folder | Y | Y | Y |
| Copy folder | Logs as Create | Y | Y |
| Move folder | Y | Y | Y |
| Empty folder | N/A | Y | N/A |
| Open mailbox | Y | Y | Y |
Exchange 2007
| Event Name | Outlook (Cached Mode) | Outlook (Non-Cached Mode) | Outlook Web Access |
|---|---|---|---|
| Read folder | Y | Y | Y |
| Recycle item | Y | Y | Y |
| Delete item | Y | Y | Y |
| Create item | Y | Y | N |
| Update item | Y | Y | Y |
| Move item | Y | Y | Y |
| Copy item | Logs as Create | Logs as Create | N/A |
| Rename folder | Y | Y | Y |
| Send message | Y | Y | Y |
| Create folder | Y | Y | Y |
| Mark read | Y | Y | Y |
| Mark unread | Y | Y | Y |
| Read item | Y | Y | Y |
| Delete folder | Y | Y | N/A |
| Recycle folder | Y | Y | Y |
| Copy folder | Logs as Create | Y | N/A |
| Move folder | Y | Y | Y |
| Empty folder | N/A | Y | Y |
| Open mailbox | Y | Y | Y |
Legend
- Items marked as Y are supported and generate the events one would expect.
- Events marked as N are not generated by the specific platform in this release.
- Events marked as N/A cannot be generated by the specified client application/configuration.
