Florida Dept. of Education: ~4.9M exposed in student financial aid site breach
https://sockanalyst.com/patch-now/florida-doe-financial-aid-breach

Splunk
index=email sourcetype IN (ms:o365:reporting:messagetrace, o365:messageTrace, cisco:esa*)
(subject="*financial aid*" OR subject="*Bright Futures*" OR subject="*scholarship*" OR subject="*FLDOE*" OR subject="*data breach*")
NOT (src_user="*@fldoe.org" OR SenderAddress="*@fldoe.org")
| stats count values(subject) as subjects by src_user, recipient

Sentinel
EmailEvents
| where Subject has_any ("financial aid","Bright Futures","scholarship","FLDOE","data breach")
| where SenderFromDomain !endswith "fldoe.org"
| summarize Count=count(), Subjects=make_set(Subject,10) by SenderFromAddress, SenderFromDomain, DeliveryAction