Security Operations & Incident Response

A new mailbox delegation or forwarding rule may be legitimate coverage or an attempt to access business messages. It can persist independently of password changes. What to check Review rule creator, delegate or recipient, scope, approval, creation time, mailbox activity, sign-ins, and provider audit records. Confirm whether messages were read, sent, or...

A login from an unmanaged device can be legitimate or indicate stolen credentials. The account may be protected by MFA while still accessing data from an endpoint outside the organization’s controls. What to check Confirm user and device context, authentication strength, access policy, data viewed or downloaded, session lifetime, and whether the device...

A new inbox rule may organize messages or secretly forward, delete, or mark security notifications as read. Rules can hide account takeover activity from the user. What to check Review rule creator and time, actions, forwarding destinations, mailbox audit logs, sign-ins, and any recent authentication changes. Check deleted items and other mailboxes...

A remote access tool may be installed for approved support or could provide an attacker with persistent control. The tool may not be managed by central endpoint policy. What to check Identify publisher, installer, account, service status, network connections, installation time, approval, and actions performed. Check whether the tool is authorized and...

An external administrator invitation may be a legitimate partner setup or an unauthorized attempt to gain persistent control. Invitations can be accepted later, after the initial alert. What to check Check inviter, invited identity and domain, role, resource scope, approval, invitation state, acceptance event, and activity after acceptance. Review...

A suspected account compromise needs prompt containment while preserving enough records to understand what happened. Deleting messages or wiping a device too early can remove useful evidence. What to check Use an approved incident contact path, record discovery time and affected account, preserve relevant sign-in and audit logs, and avoid forwarding...

A sudden absence of alerts can mean the system is quiet, or it can mean its log source, connector, credentials, or forwarding path stopped working. What to check Check source heartbeat, collection delay, connector health, authentication expiry, recent configuration changes, and whether raw events are present at the source. Compare against expected...

A security alert may be valid even when no one reports a problem, especially if the activity was blocked or occurred in the background. What to check Validate the alert source and timestamp, correlate identity and endpoint events, check the affected asset and action outcome, and compare with known maintenance. Preserve relevant logs. Recommended next...