Microsoft 365 incident response
After the initial scoping to understand the incident, the next step is to determine indicators of compromise and begin the threat hunt. This section delves into the tools and techniques that incident responders can employ to automate the log acquisition and analysis process, specifically to an organization that is utilizing Microsoft 365 as their cloud productivity suite. A key focus is on utilizing Microsoft 365’s built-in security and compliance tools, such as Microsoft Purview, to rapidly gather logs and track suspicious activities.
Tooling
In Chapter 7, we discussed the various auditing and compliance features in Microsoft 365, one of which was Microsoft unified audit logs. These logs provide a consolidated view of all Microsoft 365 activity and are critical for investigating and understanding the extent of the compromise. Here’s how incident responders can leverage the audit log search GUI in Microsoft 365 for this purpose:
...
