analyzing-office365-audit-logs-for-compromise

Name: analyzing-office365-audit-logs-for-compromise
Availability: InStock
Author: Axxxxxxaaann

Analyze Office 365 Unified Audit Logs and mailbox configurations for compromise indicators.

Updated Aug 23, 2026

Search Tags:#graph-api #audit-logs #office365 #inbox-rules #oauth-grants #compromise

Ready to run

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-office365-audit-logs-for-compromise

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: analyzing-office365-audit-logs-for-compromise
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-office365-audit-logs-for-compromise
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-office365-audit-logs-for-compromise

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires msal, requests, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Office 365 environments often conceal compromise indicators across audit logs, inbox rules, mailbox delegation, and OAuth consents, complicating detection and response. This skill provides a structured approach to query the Microsoft Graph Unified Audit Log, enumerate inbox rules across mailboxes, detect suspicious forwarding configurations, and identify indicators of compromise to accelerate response.

Core Features & Use Cases

Detect suspicious inbox rules and forwarding configurations that may indicate account compromise.
Enumerate mailbox delegation changes and OAuth consent grants to identify risky activity and attacker persistence.
Produce structured JSON reports with risk scores and attack timelines to support incident response and threat hunting.
Apply across multiple tenants and mailboxes for scalable monitoring and verification.

Quick Start

Run the Office 365 compromise audit using the agent with your Azure AD tenant, client ID, and client secret.

Frequently Asked Questions about analyzing-office365-audit-logs-for-compromise

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect suspicious inbox rules and forwarding configurations in Office 365?▼

To detect suspicious inbox rules and forwarding configurations in Office 365, you analyze the Unified Audit Log and mailbox configurations via Microsoft Graph API. This identifies risky forwarding setups and hidden rules that indicate account compromise.

What is the best way to check OAuth consent grants and mailbox delegation changes for attacker persistence?▼

The best way to check OAuth consent grants and mailbox delegation changes is to enumerate these configurations across multiple mailboxes and tenants. This identifies risky activity and attacker persistence by scanning for unauthorized consent grants and delegation modifications.

Can I use the Microsoft Graph API to query Unified Audit Logs for multiple tenants?▼

Yes, you can use the Microsoft Graph API to query Unified Audit Logs across multiple tenants and mailboxes. This approach supports scalable monitoring and verification of compromise indicators for incident response and threat hunting scenarios.

Do I need MSAL authentication and Azure AD credentials to analyze Office 365 audit logs?▼

Yes, you need MSAL authentication and Azure AD credentials including your tenant, client ID, and client secret to analyze Office 365 audit logs. These credentials are required to authenticate and access the Microsoft Graph Unified Audit Log.

How do I generate structured JSON reports with risk scores and attack timelines for incident response?▼

You generate structured JSON reports with risk scores and attack timelines by analyzing Office 365 audit logs and mailbox configurations. This produces structured outputs that map compromise indicators to support incident response and threat hunting activities.