5 queries for account compromise detection

[adrwh]

Please see 5 common queries for contribution.

• Recent security alerts

Return triggered security alerts in the last 24 hours.

• Signins by username

Return signin activity by username from the Azure SigninLogs table/log.

• Signins by ip

Return signin activity by one or more ip address from the Azure SigninLogs table/log.

• Office365 activity by username

Return activity from the Office365 unified audit log by username.

• Office365 activity by ip

Return activity from the Office365 unified audit log by one or more ip addresses.

Use case

I usually start with Recent security alerts, look for obvious anomalous behaviour. Then i copy the unfamiliar IPs and run Signins by ip and look at the activity for that IP. I compare it with Signins by username. Then i run Office365 activity by ip to see what activity was done by this IP/user and usually this is enough to confirm compromise or not.

[msftclas]

All CLA requirements met.