Ok, so this one is a doozy. I've been working on this for literally months so I honestly hope it's not a simple check box issue.
We use Wombat Security for phishing campaigns and they provide us with an Outlook plugin button for end-users to report potential phish emails to the security team (me). We configured that button to send directly to our cloud ticketing system, which automatically opens a ticket. So the end-user selects a suspect message, clicks the "Report Phish" button in Outlook, the button takes the suspect message and forwards it as an attachment to our cloud ticketing system and also attaches a text file with the header information of the suspect email. Easy peazy.
This worked flawlessly for over a year.
About two and half months ago the tickets we get from the Outlook button stopped including attachments. The email still goes through and opens a ticket but there is no header or forwarded email attachments.
Fast forward to today and here's what I've done and what I know.
I setup a transport rule in Exchange so any emails sent to the cloud ticketing email address get BCC to my work email and my gmail account. This way I can see what's actually being sent.
When I use the button to report a phish, it shows up in the sent items with both attachments.
The email I get at my work email via the transport rule has both attachments. The email I get at my gmail only contains the text file, no email attachment.
So my attachments, when sending emails via the Outlook plugin, are somehow getting dropped somewhere in transit. But I have no idea how or why or how to find out more.
So, that's my question. Where in Exchange 2010 logs (or Outlook 2016) could I find out what's happening to my attachments?
Fun little tidbit related to the issue above, when I go into my sent items, open the message sent from the Outlook plugin and just hit resend - it sends the email with attachments. Everything works as it should. Which points to the Outlook plugin being the issue EXCEPT that this happened for all my users at the same time regardless of the version of Outlook plugin they are using. We didn't upgrade Outlook version, Exchange, or the Outlook plugin. Which then points back to Exchange. Hence why I've been working on this for over 2 months.