Merge pull request MicrosoftDocs#6183 from MicrosoftDocs/ReportingUpdates-chrisda

ReportingUpdates-chrisda to Master

Author: chrisda

exchange/exchange-ps/exchange/Get-DlpDetectionsReport.md

@@ -35,22 +35,13 @@ Get-DlpDetectionsReport [-Action <MultiValuedProperty>] [-AggregateBy <String>]
 The Get-DlpDetectionsReport cmdlet returns general DLP detection data that's aggregated per day. The properties returned include:
 
 - Date
-
-- DlpPolicy
-
-- TransportRule
-
-- Action
-
-- EventType
-
-- MessageCount
-
+- DLP Policy
+- DLP Compliance Rule
+- Event Type
 - Source
+- Message Count
 
-- StartDate
-
-- EndDate
+To see all of these columns (width issues), write the output to a file. For example, `Get-DlpDetectionsReport | Out-String -Width 4096 | Out-File "C:\Users\admin\Desktop\DLP Detections Report.txt"`.
 
 To see detailed information about each DLP rule match, use the Get-DlpDetailReport cmdlet.
 
@@ -282,17 +273,13 @@ Accept wildcard characters: False
 ### -SummarizeBy
 The SummarizeBy parameter returns totals based on the values you specify. If your report filters data using any of the values accepted by this parameter, you can use the SummarizeBy parameter to summarize the results based on those values. To decrease the number of rows returned in the report, consider using the SummarizeBy parameter. Summarizing reduces the amount of data that's retrieved for the report and delivers the report faster. For example, instead of seeing each instance of a specific value of EventType on an individual row in the report, you can use the SummarizeBy parameter to see the total number of instances of that value of EventType on one row in the report.
 
-For the Get-DLPDetectionsReport cmdlet, the SummarizeBy parameter accepts the following values:
-
-- Action
+Valid values are:
 
 - DLPPolicy
-
 - Domain
-
 - EventType
 
-You can specify multiple values separated by commas.
+You can specify multiple values separated by commas. The values that you specify for this parameter are not displayed in the results (the values in the corresponding columns are blank).
 
 ```yaml
 Type: MultiValuedProperty

exchange/exchange-ps/exchange/Get-MailTrafficATPReport.md

@@ -24,10 +24,20 @@ For information about the parameter sets in the Syntax section below, see [Excha
 ## SYNTAX
 
 ```
-Get-MailTrafficATPReport [-Action <MultiValuedProperty>] [-AggregateBy <String>]
- [-Direction <MultiValuedProperty>] [-Domain <MultiValuedProperty>] [-EndDate <DateTime>]
- [-EventType <MultiValuedProperty>] [-Expression <Expression>] [-Page <Int32>] [-PageSize <Int32>]
- [-ProbeTag <String>] [-StartDate <DateTime>] [-SummarizeBy <MultiValuedProperty>] [<CommonParameters>]
+Get-MailTrafficATPReport
+ [-Action <MultiValuedProperty>]
+ [-AggregateBy <String>]
+ [-Direction <MultiValuedProperty>]
+ [-Domain <MultiValuedProperty>]
+ [-EndDate <DateTime>]
+ [-EventType <MultiValuedProperty>]
+ [-Expression <Expression>]
+ [-Page <Int32>]
+ [-PageSize <Int32>]
+ [-ProbeTag <String>]
+ [-StartDate <DateTime>]
+ [-SummarizeBy <MultiValuedProperty>]
+ [<CommonParameters>]
 ```
 
 ## DESCRIPTION
@@ -38,17 +48,18 @@ Safe Links is a feature in Advanced Threat Protection that checks links in email
 For the reporting period you specify, the cmdlet returns the following information:
 
 - Domain
-
 - Date
-
 - Event Type
-
 - Direction
-
 - Action
-
+- SubType
+- Policy Source
+- Verdict Source
+- Delivery Status
 - Message Count
 
+To see all of these columns (width issues), write the output to a file. For example, `Get-MailTrafficATPReport | Out-String -Width 4096 | Out-File "C:\Users\admin\Desktop\Mail Traffic ATP Report.txt"`.
+
 You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see [Find the permissions required to run any Exchange cmdlet](https://docs.microsoft.com/powershell/exchange/find-exchange-cmdlet-permissions).
 
 ## EXAMPLES
@@ -307,7 +318,14 @@ Accept wildcard characters: False
 ### -SummarizeBy
 The SummarizeBy parameter returns totals based on the values you specify. If your report filters data using any of the values accepted by this parameter, you can use the SummarizeBy parameter to summarize the results based on those values. To decrease the number of rows returned in the report, consider using the SummarizeBy parameter. Summarizing reduces the amount of data that's retrieved for the report and delivers the report faster. For example, instead of seeing each instance of a specific value of EventType on an individual row in the report, you can use the SummarizeBy parameter to see the total number of instances of that value of EventType on one row in the report.
 
-For the Get-MailTrafficATPReport cmdlet, valid values are Action, Direction, Domain, and EventType. You can specify multiple values separated by commas.
+Valid values are:
+
+- Action
+- Direction
+- Domain
+- EventType
+
+You can specify multiple values separated by commas. When you specify the values Action or Domain, the value is not displayed in the results (the values in the corresponding columns are blank).
 
 ```yaml
 Type: MultiValuedProperty

exchange/exchange-ps/exchange/Get-MailTrafficPolicyReport.md

@@ -32,6 +32,16 @@ Get-MailTrafficPolicyReport [-Action <MultiValuedProperty>] [-AggregateBy <Strin
 ```
 
 ## DESCRIPTION
+For the reporting period you specify, the cmdlet returns the following information:
+
+- Domain
+- Date
+- DLP Policy
+- Transport Rule
+- Event Type
+- Direction
+- Message Count
+
 You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see [Find the permissions required to run any Exchange cmdlet](https://docs.microsoft.com/powershell/exchange/find-exchange-cmdlet-permissions).
 
 ## EXAMPLES
@@ -262,7 +272,16 @@ Accept wildcard characters: False
 ### -SummarizeBy
 The SummarizeBy parameter returns totals based on the values you specify. If your report filters data using any of the values accepted by this parameter, you can use the SummarizeBy parameter to summarize the results based on those values. To decrease the number of rows returned in the report, consider using the SummarizeBy parameter. Summarizing reduces the amount of data that's retrieved for the report, and delivers the report faster. For example, instead of seeing each instance of a specific value of EventType on an individual row in the report, you can use the SummarizeBy parameter to see the total number of instances of that value of EventType on one row in the report.
 
-For the Get-MailTrafficPolicyReport cmdlet, the SummarizeBy parameter accepts the values Action, DLPPolicy, Domain, EventType, and TransportRule. You can specify multiple values separated by commas.
+Valid values are:
+
+- Action
+- Direction
+- DLPPolicy
+- Domain
+- EventType
+- TransportRule
+
+You can specify multiple values separated by commas. When you specify the values DLPPolicy, Domain, EventType, or TransportRule the value is not displayed in the results (the values in the corresponding columns are blank).
 
 ```yaml
 Type: MultiValuedProperty

exchange/exchange-ps/exchange/Get-MailTrafficReport.md

@@ -41,7 +41,17 @@ Get-MailTrafficReport
 ```
 
 ## DESCRIPTION
-You can use the EventTypes values from the Get-MailTrafficReport cmdlet to analyze what happened to messages when they were filtered by the service. The following list describes the event types for messages.
+For the reporting period you specify, the cmdlet returns the following information:
+
+- Domain (note that this value is populated only when you use the Domain parameter)
+- Date
+- Event Type
+- Direction
+- Action
+- Message Count
+- Recipient Count
+
+You can use the EventType values from the Get-MailTrafficReport cmdlet to analyze what happened to messages when they were filtered by the service. The following list describes the event types for messages.
 
 Mail traffic summary
 
@@ -63,7 +73,7 @@ Mail traffic summary
 
 - TransportRuleHits: Messages that matched a transport rule. If a message matched multiple rules, this event type would show each of the rule matches.
 
--	TransportRuleMessages: Messages that matched a transport rule. If a message matched multiple rules, this event type would show each of the rule matches.
+- TransportRuleMessages: Messages that matched a transport rule. If a message matched multiple rules, this event type would show each of the rule matches.
 
 Spam detections
 
@@ -139,7 +149,7 @@ This example retrieves the statistics for outgoing messages on December 12, 2015
 
 ### Example 3
 ```powershell
-Get-MailTrafficReport -StartDate 12/12/2015 -EndDate 12/12/2015 -Direction Outbound -SummarizeBy Domain,EventType | Format-Table Domain,Date,EventType,Action,MessageCount
+Get-MailTrafficReport -StartDate 12/12/2015 -EndDate 12/12/2015 -Direction Outbound -SummarizeBy EventType | Format-Table Domain,Date,Action,MessageCount
 ```
 
 This example is similar to the previous example, but now the results are summarized. Because the EventType is one of the summarized values, the rows in the table now contain the unique values of Action. The total number of rows in the report is reduced, and values of MessageCount are correspondingly larger on each row.
@@ -341,7 +351,13 @@ Accept wildcard characters: False
 ### -SummarizeBy
 The SummarizeBy parameter returns totals based on the values you specify. If your report filters data using any of the values accepted by this parameter, you can use the SummarizeBy parameter to summarize the results based on those values. To decrease the number of rows returned in the report, consider using the SummarizeBy parameter. Summarizing reduces the amount of data that's retrieved for the report, and delivers the report faster. For example, instead of seeing each instance of a specific value of EventType on an individual row in the report, you can use the SummarizeBy parameter to see the total number of instances of that value of EventType on one row in the report.
 
-For the Get-MailTrafficReport cmdlet, the SummarizeBy parameter accepts the values Action, Domain, and EventType. You can specify multiple values separated by commas.
+Valid values are:
+
+- Action
+- Domain
+- EventType
+
+You can specify multiple values separated by commas. The values that you specify for this parameter are not displayed in the results (the values in the corresponding columns are blank).
 
 ```yaml
 Type: MultiValuedProperty

exchange/exchange-ps/exchange/Get-MailTrafficTopReport.md

@@ -31,6 +31,17 @@ Get-MailTrafficTopReport [-Action <MultiValuedProperty>] [-AggregateBy <String>]
 ```
 
 ## DESCRIPTION
+For the reporting period you specify, the cmdlet returns the following information:
+
+- Domain
+- Date
+- Name
+- Event Type
+- Direction
+- Count
+
+To see all of these columns (width issues), write the output to a file. For example, `Get-MailTrafficTopReport | Out-String -Width 4096 | Out-File "C:\Users\admin\Desktop\Mail Traffic Top Report.txt"`.
+
 You need to be assigned permissions before you can run this cmdlet. Although this topic lists all parameters for the cmdlet, you may not have access to some parameters if they're not included in the permissions assigned to you. To find the permissions required to run any cmdlet or parameter in your organization, see [Find the permissions required to run any Exchange cmdlet](https://docs.microsoft.com/powershell/exchange/find-exchange-cmdlet-permissions).
 
 ## EXAMPLES
@@ -231,7 +242,12 @@ Accept wildcard characters: False
 ### -SummarizeBy
 The SummarizeBy parameter returns totals based on the values you specify. If your report filters data using any of the values accepted by this parameter, you can use the SummarizeBy parameter to summarize the results based on those values. To decrease the number of rows returned in the report, consider using the SummarizeBy parameter. Summarizing reduces the amount of data that's retrieved for the report and delivers the report faster. For example, instead of seeing each instance of a specific value of EventType on an individual row in the report, you can use the SummarizeBy parameter to see the total number of instances of that value of EventType on one row in the report.
 
-For the Get-MailTopTrafficReport cmdlet, the SummarizeBy parameter accepts the values Domain and EventType. You can specify multiple values separated by commas.
+Valid values are:
+
+- Domain
+- EventType
+
+You can specify multiple values separated by commas. The values that you specify for this parameter are not displayed in the results (the values in the corresponding columns are blank).
 
 ```yaml
 Type: MultiValuedProperty

exchange/exchange-ps/exchange/Get-SafeLinksAggregateReport.md

@@ -36,7 +36,7 @@ Get-SafeLinksAggregateReport
 ## DESCRIPTION
 Safe Links is a feature in Advanced Threat Protection that checks links in email messages to see if they lead to malicious web sites. When a user clicks a link in a message, the URL is temporarily rewritten and checked against a list of known, malicious web sites.
 
-This cmdlet returns the following information:
+For the reporting period you specify, the cmdlet returns the following information:
 
 - Action
 - App