Add "X-Originating-IP" as a searchable attribute in Content Search?
Could you make the "X-Originating-IP" header attribute searchable via Content Search? We've had a confirmed Spear Phishing attempt and we're in need of determining if any other people in our organization have been getting messages from a certain IP.
Thanks for your help!
Yeah Teams IM message appears in Content Search but not via Message Trace which is no good when your trying to track the IP address of a guest user that sent a message within a Teams meeting with inappropriate content.
If anyone knows how, please let me know. :)
I believe this is already possible in the Mail flow search.
Mailflow > Message Trace > Start a Trace.
Leave everything blank
More Search Options > Original client IP address > Enter IP
It will then show up under downloadable reports
Jose Sisto commented
This is a complete have to. I can't even imagine why is not there. I believe all IPs involved should be indexed but this one is one of the most importants.