Hi, would it be possible for the Timeline incident reporting to show the ID of an email and also the time it was accessed by the threatactor? Sometimes there can be multiple emails with the same subject heading, so we would need something extra in order to determine exactly which email was accessed. It would also assist when using MS Purview, as we have the ability to load the email ID's into a search and then generate a report/copy the accessed emails into a PST.