index="REPLACE_WITH_O365_INDEX" sourcetype="o365:reporting:messagetrace" earliest=-30d latest=now
| eval sender_domain=lower(mvindex(split(SenderAddress, "@"), 1))
| search sender_domain IN ("REPLACE_WITH_SUPPLIER_DOMAIN")
| stats count AS messages dc(RecipientAddress) AS recipients min(_time) AS first_seen max(_time) AS last_seen values(Subject) AS subjects BY SenderAddress
| convert ctime(first_seen) ctime(last_seen)
| sort - recipients
| head 500