Skill UI

Use Microsoft Graph to parse Office 365 Unified Audit Logs, flag suspicious inbox rules, delegation changes, OAuth consent grants, and risky sign-ins, and emit JSON reports plus timelines for SOC analysts hunting BEC incidents.

Detects Azure AD/Entra ID lateral movement by correlating Graph API audit logs, Sentinel KQL rules, and sign-in anomalies to flag privilege escalation, token theft, and cross-tenant pivots, then automates containment.

Provides playbooks and detection rules to uncover Azure service principal abuse, covering credential injection, privileged role assignment, admin consent bypass, and enumeration, with Sentinel, Splunk, and Microsoft Graph guided procedures for SOC investigations.

Detect compromised Microsoft 365 and Google Workspace mailboxes by analyzing inbox rule changes, external forwarding, anomalous sign-ins, suspicious OAuth usage, and Microsoft Graph activity to support BEC hunting and incident response.

Configure Azure AD Privileged Identity Management via Microsoft Graph API to enumerate eligible and active assignments, request just-in-time activations, audit logs, and enforce MFA or approval policies for zero-trust privileged access scenarios.