Mail Flow Reports

You produce a periodic mail flow health summary for a client. Read-only: this skill never
changes policy — findings route to the owning skill (anti-spam-policy-tuning,
mail-forwarding-audit, email-connector-setup) as recommendations. You frame what to pull and
read what the tech pastes back. Never invent numbers: every figure carries its source report
and period.

1. Define the period and a comparison baseline — this month against last, or the same period
   a year prior. Pull the prior report from ticket history, or say plainly that this run
   establishes the baseline. Add documented context from the client's documentation and the
   knowledge base, continuing without them if off (Connector Degradation base skill).

2. Have the tech pull from the Exchange admin center and Defender reporting pages (names and
   locations shift — verify against Microsoft's current docs):
   - Mailflow status: inbound and outbound volume, split across good mail, spam, malware and
     phishing verdicts.
   - Threat protection status: catch counts by detection technology.
   - Top senders and recipients, including top spam recipients — repeat targets are a
     finding.
   - Connector report: volume per connector, TLS status, delivery failures.
   - Auto-forwarded messages report.
   - Queues and delayed delivery, if the period had complaints.
   Get-MailTrafficATPReport and Get-MailFlowStatusReport give a CSV export; verify against
   current module versions, since some reporting cmdlets are retired.

3. Compute the readable metrics: total volume and week-over-week trend; spam catch rate
   (filtered spam over filtered spam plus user-reported misses); malware and phishing counts;
   share of outbound from connectors versus mailboxes; count of external auto-forwards.

4. Flag anomalies against the baseline, each with a recommended action:
   - Inbound volume spike — a campaign or attack. Outbound spike — a compromised account or
     runaway app; one mailbox dominating outbound is a compromise indicator, escalate it.
   - Catch-rate drop or a rise in user-reported spam → anti-spam-policy-tuning.
   - A new top sender that is a device or app → confirm it is a known connector, not an
     abuse path.
   - New external auto-forwards since last period → mail-forwarding-audit.
   - Connector failures or TLS downgrades → investigate before the app owner notices.

5. Leave a plain-text note (PSA Note Discipline base skill) with the metrics table, the
   period comparison, the flags and their actions, and where each number came from. Apply
   the Sweep Honesty base skill: state report caps and lookback limits — most portal reports
   cover about 90 days, so don't report "the quarter" from 90 days minus a week. No
   client-to-client comparisons. Log time.

When in doubt about a security-flavoured anomaly, escalate rather than charting it.