Event ID - 1211

Event Id1211
SourceMSExchangeIS Public Store
DescriptionUser <user name> used ROWLIST_REPLACE to delete all rules in folder <folder name>. <value> rules got deleted and <value> rules were added.
Event InformationNo user action is required.
Reference Links

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.