Identity Threat Protection now detects suspicious file activity in SharePoint and OneDrive.
A compromised account rarely stops at the inbox. Attackers go after your files next, searching for sensitive items and then pulling data down in bulk. Now your team can catch that activity as it happens and investigate it as part of one case, instead of piecing it together across tools.
With this release:
— Catch mass downloads and deletions that look like automation, before an attacker walks out with your files
— Spot scripted or programmatic file access by a compromised account
— Spot searches for sensitive keywords in SharePoint, an early sign an attacker is hunting for data to steal
— Investigate file activity in the same case as related sign-in signals, with no stitching together of separate alerts
Security teams can now see data theft in progress and respond before sensitive files leave the organization.
