Microsoft 365 microsoft native alert
Microsoft's own security tooling (Defender for Office 365 / Microsoft Purview / Cloud App Security) raised an alert that is recorded in the Unified Audit…
What it detects
Microsoft's own security tooling (Defender for Office 365 / Microsoft Purview / Cloud App Security) raised an alert that is recorded in the Unified Audit Log (AlertEntityGenerated / AlertTriggered). These are high-fidelity, first-party detections already present in the data — surfacing them as findings means an analyst does not miss what Microsoft has itself flagged. Open the event evidence for the alert's name, severity, and policy.
MITRE ATT&CK mapping
- T1078.004Valid Accounts: Cloud Accounts· Initial Access
False positives and triage
Microsoft alerts vary in severity and some are informational or tuned-out in the source tenant. Read the alert name/severity in the evidence and correlate with the account's other activity; treat a Microsoft alert as a strong lead, not a verdict.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/cloud/m365_microsoft_native_alert.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_microsoft_native_alert
version: 1.0.0
status: stable
severity: medium
confidence: 0.7
platforms: [application]
mitre_techniques: [T1078.004]
description: |
Microsoft's own security tooling (Defender for Office 365 / Microsoft Purview /
Cloud App Security) raised an alert that is recorded in the Unified Audit Log
(AlertEntityGenerated / AlertTriggered). These are high-fidelity, first-party
detections already present in the data — surfacing them as findings means an
analyst does not miss what Microsoft has itself flagged. Open the event evidence
for the alert's name, severity, and policy.
match:
provider: Office365
event_action_any:
- AlertEntityGenerated
- AlertTriggered
- SecurityComplianceAlerts
correlation_keys: [user_name]
false_positive_guidance: |
Microsoft alerts vary in severity and some are informational or tuned-out in the
source tenant. Read the alert name/severity in the evidence and correlate with the
account's other activity; treat a Microsoft alert as a strong lead, not a verdict.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.