// Defender XDR; replace with the onboarded Zimbra DeviceName.
let MailServer = "REPLACE_WITH_ZIMBRA_DEVICE_NAME";
DeviceNetworkEvents
| where Timestamp >= ago(7d)
| where DeviceName =~ MailServer
| where RemoteIP in ("45.32.30.235", "193.42.40.135")
    or RemoteUrl in~ ("transzimbra.linkpc.net", "psk1zim.abrdns.com",
                     "tls.psk1zim.abrdns.com", "wslogzimbra.linkpc.net")
| project Timestamp, DeviceName, ActionType, RemoteIP, RemotePort, RemoteUrl,
          InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc
| take 200