Unified Audit Log Retention, Licensing and Missing Logs
What Microsoft 365 and Entra ID logs keep, for how long, on which licence, and what a BEC investigation cannot see when a source is missing or disabled.
Posts tagged: #microsoft-365
BEC Response: What to Do in the First Hour (Microsoft 365)
The first hour after a Microsoft 365 business email compromise: stop the money, keep the logs, revoke sessions and remove persistence, in the right order.
MailItemsAccessed: What It Proves (and What It Doesn't)
Reading MailItemsAccessed records in a BEC case: Sync vs Bind, InternetMessageId, throttling, licensing, and telling the attacker's reads from the user's.
Check Inbox Rules for a Hacker in Microsoft 365
How attackers use inbox rules and forwarding in a BEC, how to find them in the Unified Audit Log and with Get-InboxRule, and how to tell them from real ones.
Unified Audit Log Investigation: Fields That Matter for BEC
Reading the Unified Audit Log in a BEC case: the AuditData JSON, the operations to filter on, and how SessionId and UniqueTokenId link actions to sign-ins.
How to Analyze the Unified Audit Log in Your Browser
Walkthrough: load a Purview audit export and Entra sign-in logs into M365 Forensics, then read the verdict, findings, timeline and remediation list.
How to Export the Unified Audit Log and Entra Sign-in Logs
Step-by-step export of the Purview Unified Audit Log and Entra ID sign-in and audit logs for a BEC case: roles, row limits, PowerShell paging, pitfalls.
Microsoft 365 BEC Investigation: A Practitioner's Guide
How to investigate business email compromise in Microsoft 365: which logs to pull, what to look for in each, how to tie actions to the attacker's session.