//Recon Email Search
EmailEvents
| where Subject matches regex @"^Hi\s\w+$"
    and SenderFromDomain !=@"@wales.domain" 
    and SenderMailFromAddress !startswith @"bounces"
| join kind=inner (IdentityInfo
    |where DistinguishedName contains_cs "HDD/PATH" //desired OU path to search for goes here, case sensitive
        )on $left.RecipientEmailAddress == $right.AccountUpn
| extend EmailBlocked =
    iif (LatestDeliveryLocation != "Inbox/folder", "Yes","No")
| project DistinguishedName, Timestamp, EmailBlocked, NetworkMessageId, SenderMailFromAddress, SenderDisplayName, SenderFromDomain, RecipientEmailAddress, Subject, UrlCount, AttachmentCount
| sort by Timestamp desc
 