m365:tenant
Microsoft 365 tenant
Exchange, SharePoint, Teams and Defender XDR activity.
- Host type
- Microsoft 365
- Standards scope
- cloud; m365
- Minimum events
- 8
- Recommended events
- 54
- Log sources
- 4
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| Microsoft Defender XDR advanced hunting tables | Minimum | 5 | 353 |
| Exchange Online message trace | Recommended | 5 | 4 |
| Microsoft 365 Unified Audit Log | Minimum | 76 | 197 |
Minimum
8 events meet the minimum bar for this role: an ATT&CK analytic names each one, and either a standard in the role's scope requires it or at least the platform's threshold of vendor rules depends on it. Grouped by log source; the source heading carries the cost class.
Microsoft 365 Unified Audit Log8 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| Add-MailboxPermission | 3 | Splunk 1, Elastic 1, Microsoft Sentinel 3 | ||
| FileDownloaded | 2 | Elastic 2, Microsoft Sentinel 1 | ||
| FileUploaded | 1 | Microsoft Sentinel 3 | ||
| MailItemsAccessed | 2 | Splunk 3, Elastic 3, Microsoft Sentinel 1 | CISA | |
| New-InboxRule | 2 | Elastic 3, Microsoft Sentinel 5 | ||
| Set-InboxRule | 2 | Elastic 3, Microsoft Sentinel 3 | ||
| Set-Mailbox | 6 | Elastic 2, Microsoft Sentinel 3 | ||
| UserLoggedIn | 2 | Splunk 2, Elastic 5 |
Recommended
54 more events meet one of the three criteria. Each source opens on its own.