How to Analyze the Unified Audit Log in Your Browser
Walkthrough: load a Purview audit export and Entra sign-in logs into M365 Forensics, then read the verdict, findings, timeline and remediation list.
Blog
How to Export the Unified Audit Log and Entra Sign-in Logs
Step-by-step export of the Purview Unified Audit Log and Entra ID sign-in and audit logs for a BEC case: roles, row limits, PowerShell paging, pitfalls.
Microsoft 365 BEC Investigation: A Practitioner's Guide
How to investigate business email compromise in Microsoft 365: which logs to pull, what to look for in each, how to tie actions to the attacker's session.