| splunk |
O365 User Consent Blocked for Risky Application |
production |
2026-05-13 |
| splunk |
O365 Threat Intelligence Suspicious File Detected |
production |
2026-05-13 |
| splunk |
O365 Threat Intelligence Suspicious Email Delivered |
production |
2026-05-13 |
| splunk |
O365 Tenant Wide Admin Consent Granted |
production |
2026-05-13 |
| splunk |
O365 SharePoint Suspicious Search Behavior |
production |
2026-05-13 |
| splunk |
O365 SharePoint Malware Detection |
production |
2026-05-13 |
| splunk |
O365 Service Principal New Client Credentials |
production |
2026-05-13 |
| splunk |
O365 Security And Compliance Alert Triggered |
production |
2026-05-13 |
| splunk |
O365 Safe Links Detection |
production |
2026-05-13 |
| splunk |
O365 PST export alert |
production |
2026-05-13 |
| splunk |
O365 Privileged Graph API Permission Assigned |
production |
2026-05-13 |
| splunk |
O365 OAuth App Mailbox Access via Graph API |
production |
2026-05-13 |
| splunk |
O365 OAuth App Mailbox Access via EWS |
production |
2026-05-13 |
| splunk |
O365 New MFA Method Registered |
production |
2026-05-13 |
| splunk |
O365 New Forwarding Mailflow Rule Created |
production |
2026-05-13 |
| splunk |
O365 New Federated Domain Added |
production |
2026-05-13 |
| splunk |
O365 New Email Forwarding Rule Enabled |
production |
2026-05-13 |
| splunk |
O365 New Email Forwarding Rule Created |
production |
2026-05-13 |
| splunk |
O365 Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
O365 Multiple Service Principals Created by User |
production |
2026-05-13 |
| splunk |
O365 Multiple Service Principals Created by SP |
production |
2026-05-13 |
| splunk |
O365 Multiple OS Vendors Authenticating From User |
production |
2026-05-13 |
| splunk |
O365 Multiple Mailboxes Accessed via API |
production |
2026-05-13 |
| splunk |
O365 Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
O365 Multiple AppIDs and UserAgents Authentication Spike |
production |
2026-05-13 |
| splunk |
O365 Multi-Source Failed Authentications Spike |
production |
2026-05-13 |
| splunk |
O365 Mailbox Read Access Granted to Application |
production |
2026-05-13 |
| splunk |
O365 Mailbox Inbox Folder Shared with All Users |
production |
2026-05-13 |
| splunk |
O365 Mailbox Folder Read Permission Granted |
production |
2026-05-13 |
| splunk |
O365 Mailbox Folder Read Permission Assigned |
production |
2026-05-13 |
| splunk |
O365 Mailbox Email Forwarding Enabled |
production |
2026-05-13 |
| splunk |
O365 Mail Permissioned Application Consent Granted by User |
production |
2026-05-13 |
| splunk |
O365 High Privilege Role Granted |
production |
2026-05-13 |
| splunk |
O365 High Number Of Failed Authentications for User |
production |
2026-05-13 |
| splunk |
O365 FullAccessAsApp Permission Assigned |
production |
2026-05-13 |
| splunk |
O365 SharePoint Allowed Domains Policy Changed |
production |
2026-05-13 |
| splunk |
O365 File Permissioned Application Consent Granted by User |
production |
2026-05-13 |
| splunk |
O365 External Identity Policy Changed |
production |
2026-05-13 |
| splunk |
O365 External Guest User Invited |
production |
2026-05-13 |
| splunk |
O365 Exfiltration via File Sync Download |
production |
2026-05-13 |