| elastic |
Microsoft Graph Email Access by Unusual User and Client |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Items Accessed Excessively |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
Exporting Exchange Mailbox via PowerShell |
production |
2026-09-18 |
| elastic |
Exchange Mailbox Export via PowerShell |
production |
2026-09-18 |
| elastic |
PowerShell Mailbox Collection Script |
production |
2026-09-18 |
| elastic |
New ActiveSyncAllowedDeviceID Added via PowerShell |
production |
2026-09-18 |
| splunk |
O365 Multiple Mailboxes Accessed via API |
production |
2026-05-13 |
| splunk |
O365 OAuth App Mailbox Access via EWS |
production |
2026-05-13 |
| splunk |
Email servers sending high volume traffic to hosts |
experimental |
2026-05-13 |
| splunk |
Hosts receiving high volume of network traffic from email server |
experimental |
2026-05-13 |
| splunk |
O365 OAuth App Mailbox Access via Graph API |
production |
2026-05-13 |
| splunk |
O365 Compliance Content Search Exported |
production |
2026-05-13 |
| splunk |
O365 Compliance Content Search Started |
production |
2026-05-13 |
| splunk |
O365 Email Access By Security Administrator |
production |
2026-05-13 |
| splunk |
O365 Email Suspicious Search Behavior |
production |
2026-05-13 |
| splunk |
O365 Mailbox Inbox Folder Shared with All Users |
production |
2026-05-13 |
| splunk |
O365 Mailbox Read Access Granted to Application |
production |
2026-05-13 |