Don’t Disable this if you use Azure Email Communication

EmailEvents
|where Timestamp > ago(7d)
|where EmailDirection == 'Inbound' and Connectors == '' and isnotempty(SenderIPv4) and SenderMailFromDomain == "domain.com.au" and SenderFromDomain == "domain.com.au"