Send Critical Microsoft 365 Logs to Your SIEM

Make Your SIEM See M365: The Missing Logs, the Real Costs, and the Detections That Matter

What this session covers

• Which Microsoft 365 events your SIEM doesn’t ingest by default (and why)

• The true cost/volume of “complete” visibility—and how to filter smart, not less

• A resilient, throttling-aware pipeline (API/Event Hub/collector) that won’t drop incidents

• Field normalization + enrichment so analysts don’t need a decoder ring

• Ready-to-use detections that catch attacker behavior in Exchange/SharePoint/Teams/Power Platform

The blind spots (common across Sentinel, Splunk, QRadar)

• Exchange: Non-owner mailbox access, rule/forwarding creation, SendAs/SendOnBehalf, mailbox permission changes

• SharePoint/OneDrive: External/anonymous link creation & use, file reshares, privileged site permission changes

• Teams: External sharing via SharePoint-backed channels, message deletions/edits, meeting policy & app sideload changes

• Power Platform: Flow/app creation & spikes, connector use (Outlook/Teams/HTTP), DLP policy bypasses

• Sensitivity & DLP: Label/apply/remove events, policy hits, overrides (often E5/Advanced Audit gated)

• Azure AD context you need but rarely pipe: Risky sign-ins, CA outcomes, device/geo anomalies

Why you’re not seeing them

• Licensing gates (Advanced Audit/E5 for rich Exchange/SharePoint/Label events)

• Connector scope limits (only “OfficeActivity” basics, not advanced workloads)

• API throughput/throttling and batching delays

• Parser gaps (JSON blobs with unmapped fields; silent schema changes)

• Cost controls that quietly exclude “noisy” categories

Cost control without going blind

• Filter upstream: include only high-signal ops (e.g., New-InboxRule, Add-MailboxPermission, anonymous link created/used)

• Deduplicate/roll-up chatty events (SharePoint version saves, background sync) before ingestion

• Tier storage: hot (30–60d) for investigations; cold/archive for compliance horizons

• Sample low-value categories during peaks; keep full-fidelity for high-risk tenants/VIPs

• Model volume before enabling: forecast GB/day by source; double for spikes (audits, quarter-end)

Resilient pipeline (pattern)

• Source: M365 Unified Audit Log + Advanced Audit + AAD sign-ins/risk + MIP/DLP + Defender alerts

• Transport: Graph/Management API → Azure Event Hub (buffer & replay) → SIEM

• Processing: Normalize + enrich at landing (user, dept, VIP flag, device, geo, sensitivity, CA result)

• Governance: Daily completeness checks, 429 backoff, schema change watch, dead-letter queue alerts

Normalization & enrichment (make it analyst-ready)

• Flatten key fields: Actor, Target, Action, ResourcePath, LinkType (anon/org/people), ExternalRecipient, LabelName

• Map to a unified schema (e.g., ASIM/Elastic Common Schema) so detections span workloads

• Enrich with HR (role, org, employment type), VIP lists, partner allowlists, device compliance, sensitivity levels

High-signal detections to deploy now

• Mailbox exfil: New rule → forward to external / move to RSS/Junk within 1h of login from new geo/device

• Stealth access: Non-owner mailbox access to VIP + Add-MailboxPermission in prior 24h

• SharePoint spill: Anonymous or “specific people” link created on labeled (Confidential/Restricted) file

• Link abuse: >N external downloads within 15m from a fresh sharing link (new IP/ASN)

• Teams pivot: Share to external → same user adds external guest to Team within 2h

• Power Automate abuse: 3× daily flow creation spike by non-developer + HTTP/Outlook connectors used

• Privilege creep: Repeated Add/Remove Member/Admin on the same workspace/site within 24h

• Stale truth: Dataset refresh failed ≥2 cycles on executive/finance content (decisions on stale data)

30-day close-the-gap plan

• Week 1: Turn on Advanced Audit where needed; inventory current SIEM connectors; map missing categories

• Week 2: Stand up Event Hub; route UAL/Advanced Audit/AAD/Defender; implement upstream filters

• Week 3: Normalize + enrich; backfill 30 days; ship the 7 detections above with suppression windows

• Week 4: Cost tune (drop noise, tier retention), add completeness monitors, run a purple-team tabletop (mailbox rule + external share + flow spike)

Executive KPIs (prove it worked)

• Coverage: % of targeted M365 event families ingested & parsed (goal ≥95%)

• MTTA/MTTR for M365 incidents (trend ↓)

• Noise: Alert-to-true-positive ratio (trend ↑ signal)

• Cost: $/GB ingested (trend ↓ ~40% via upstream filtering)

• Reliability: Days with ingestion gaps = 0; schema change SLA ≤7 days to parser update

Common gotchas (and fixes)

• “We turned it on” but logs don’t exist → Advanced Audit/license check & mailbox auditing baseline

• SIEM rules silent on real attacks → build correlation (rule creation + geo change + external share)

• Bills explode → pre-filter noisy ops, archive long-tail, exclude background saves

• Parsers rot → monthly schema diff + unit tests against sample payloads

• Analyst pain → add who/what/where/label to every alert; link to Compliance Center deep dive

Bottom line
Default connectors keep you compliant, not protected. Pull the right M365 logs, normalize them, enrich with business context, and hunt with detections tuned to attacker behavior. That’s how your SIEM stops missing the story—and starts writing it.