Demystifying BEC Threat Detection in Microsoft 365
When it comes to threat detection on Business Email Compromise (BEC) in Microsoft 365, a new engineer can quickly become overwhelmed- which log sources contain the events I need? Which events do I need to look for? How do I make sure I'm getting all the events I need? Finally, how do I create good detections with the events I'm getting? This webcast familiarizes new threat detection engineers with critical log sources and provides guidance on creating production-ready detections.
Learning Objectives
- Understand log events related to Business Email Compromise (BEC)
- Familiarization with log sources in Entra ID and Microsoft 365
- Understanding and enabling mailbox auditing events
- Creating and tuning detections in KQL
