- Add Mailbox Permission NT AUTHORITY\SYSTEM
- Alert Severity Changed
- Alert suppressed
- Anonymous Link Changed – OneDrive
- Application Event - SaaS Integration
- Application Integration Detail - SaaS Application File Share
- Application Integration Detail - SaaS Application Link Share
- Device Event - New Device
- Event Description AADJ CSP
- File Event with username urn:spo:anon#************************* or anonymous
- File Share Event - External
- File Share Event - External File Share Risk
- File Share Event - External Orphaned Link
- File Share Event - Internal
- File Share Event - Local Download
- Google File Share Events
- IAM Event - Account Locked
- IAM Event - Authentication Failure
- IAM Event - Authentication Revoked
- IAM Event - Authentication Success (Logged Event)
- IAM Event - Authentication Success (on Map)
- IAM Event - Conditional Access Violation
- IAM Event - Multiple Account Locks
- IAM Event - Multiple Authentication Failures
- IAM Event - Multiple Authentication Failures Why is there “Hex Code” in a Username
- IAM Event - Multiple Login Connections From Different IP Addresses
- IAM Event - Multiple Password Reset
- IAM Event - Multiple SaaS Connections From Different IP Addresses
- IAM Event - New User Added
- IAM Event - Oauth Access Used for Foreign Application