Office 365 Compromise Analysis

This skill empowers security teams and SOC analysts to automate the investigation of potential Microsoft Office 365 account takeovers. By leveraging the Microsoft Graph API, it systematically scans Unified Audit Logs for high-risk activities such as suspicious inbox forwarding rules, unauthorized mailbox delegation changes, and malicious OAuth application grants. It provides a structured, automated approach to identifying lateral movement and data exfiltration attempts, producing a comprehensive JSON-based compromise indicator report with a clear incident timeline for rapid response.

主な機能

ユースケース