diff --git a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
new file mode 100644
index 000000000..3c68dc606
--- /dev/null
+++ b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:2d0a6bbfdb7d44cc4b9fafc369c108e339a6c10f31de0b4261584abf99de84ee
+size 1716
diff --git a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml
index 391323b4f..a1b70957f 100644
--- a/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml
+++ b/datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_suspect_email_actions.yml
@@ -9,7 +9,11 @@ mitre_technique:
 datasets:
 - name: o365_messagetrace_suspect_events
   path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_messagetrace_suspect_events.log
-  sourcetype: o365:management:activity
+  sourcetype: o365:reporting:messagetrace
+  source: o365
+- name: o365_graph_messagetrace_suspect_events
+  path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_graph_messagetrace_suspect_events.log
+  sourcetype: o365:graph:messagetrace
   source: o365
 - name: o365_exchange_suspect_events
   path: /datasets/attack_techniques/T1114/o365_suspect_email_actions/o365_exchange_suspect_events.log