Security Operations & Incident Response

A deletion spike may be caused by lifecycle changes, cleanup automation, administrative action, or a compromised identity. Checks to make Preserve audit events and backup job history, identify actor, policy, and affected resources, and compare with approved changes. Confirm recoverability from remaining copies, then restrict destructive access if...

A spike may come from approved provisioning automation, a broad access change, or misuse of privileged credentials. Checks to make Review identity and audit events by actor, role, target, and time; compare with approved changes and deployment records; and inspect subsequent actions. Preserve evidence and remove unauthorized grants through the incident...

A quiet security console can mean fewer incidents, but it can also indicate that agents, connectors, certificates, or ingestion pipelines stopped sending data. Loss of telemetry should be treated as a visibility gap until verified. What to check Check source health dashboards, last-seen times, agent service state, update status, network connectivity,...

A spike in failed sign-ins can reflect a password spray, a misconfigured application, an expired credential, or a normal user change such as a device rollout. Blocking all affected accounts without context may interrupt operations while missing the actual source. What to check Group events by source, target accounts, application, location, and time....

A newly created administrator account may be a planned deployment identity or an unauthorized persistence mechanism. The account name alone does not establish intent, and removing it immediately can disrupt production if it is legitimate. What to investigate Check creator identity, approval records, creation time, role assignments, authentication...

A large download may be legitimate work, a backup, or an unauthorized export. The volume alone does not identify intent, and delaying review can allow sensitive information to leave the organization. What to check Check actor, resource, destination, time, authentication context, device, prior behavior, and any approved export request. Correlate cloud...

A newly created forwarding rule may be a legitimate workflow or a way to quietly copy business messages outside the organization. The rule can be hidden in mailbox settings and remain active after a password reset. What to check Identify who created the rule, its destination, creation time, account sign-ins, mailbox audit events, and any matching...

A newly approved OAuth app may be an employee productivity tool or a malicious integration seeking persistent access to mail, files, or contacts. Revoking it without checking could interrupt work, while ignoring it may leave data exposed. What to check Identify the app publisher, consenting user, granted scopes, creation time, tenant-wide consent,...