Let me put a different spin on it. Since you appear to have no SMA and reporting is important to you what about about the idea of exporting the log files to a SIEM like XPOLOG , elastic search or Splunk instead ?
That way you could query any data of your ESA.
To create the new CLF for mail proceed as follows:
a) system administration/log subscriptions
b) Add log subscription as it is not enabled by default
c) Select type "Consoldiated Event Logs" and fill out the remaining details of that form like names, path etc.
d) Submit and Commit.
If I where a smaller company my priority would be :
Mail Box AutoRemediation , as it gives you immediate help when a verdict of a message changes.
Common Log File , as it gives you a better faster understanding what is happening for troubleshooting
and reporting
Safe Print , to see if that feature can mitigate some risk for you from file attachments/macros
SAML, should you have a policy that access needs to be validated via a central system and MFA
The new GUI is only partial for now so while it is interesteing to get an understanding of it as it has limited use for now as the configuration part is still using the old UI.
I hope that helps
-Marc
