Skill UI

Use Microsoft Graph to parse Office 365 Unified Audit Logs, enumerate inbox rules, spotting forwarding, delegation, OAuth grants, and other indicators of business email compromise for detection and investigation workflows.

Detect Azure AD/Entra ID lateral movement by correlating Microsoft Graph audit logs, sign-in anomalies, and Sentinel KQL rules to surface credential abuse, token theft, and cross-tenant pivots, then automate responses via playbooks.

Guides defenders through detecting and investigating Azure service principal abuse—ranging from unauthorized credential additions and privileged role grants to admin consent bypass and OAuth escalation—using Sentinel/Splunk queries and Graph-powered investigation steps.

Analyze Microsoft 365 audit logs, inbox rules, sign-in data, and Graph API activity to spot compromised O365 and Google Workspace mailboxes, then report malicious forwarding, impossible travel, suspicious OAuth access, and containment steps.

Analyzes OAuth sign-in telemetry via Microsoft Graph and Okta APIs to spot impossible travel, new device patterns, token replay from unusual IPs, and anomalous scope requests, enabling early detection of access token theft.

Detect illicit consent grant attacks in Azure AD/Entra ID by using Microsoft Graph to inspect OAuth2 permissions, analyze application scope risk, review audit logs, and report suspicious apps.

Configure Azure AD Privileged Identity Management via Microsoft Graph API to enumerate eligible and active assignments, request just-in-time activations, audit logs, and enforce MFA or approval policies for zero-trust privileged access scenarios.