New Microsoft Incident Response guides help security teams analyze suspicious activity

Microsoft Incident Response announces two concise guides to streamline investigations in Microsoft 365 and Microsoft Entra, focusing on high-value Unified Audit Log and Entra audit/sign-in events, access methods (portal, Graph PowerShell, Microsoft Graph API), and contextual cues for notable operations (e.g., SearchQuery*, SearchExportDownloaded, bulk actions, certificates/secrets updates, Elevate Access). The guidance emphasizes efficient data triage, correlation across logs, and recognizing behaviors commonly leveraged by threat actors to accelerate incident response.