Just got hit with a cryptolocker MDE didn't catch. Log analysis tips?

First off, sorry you're dealing with this. It's a stressful situation even for experienced folks. The incident page can indeed feel like drinking from a firehose.

For your immediate log analysis, I'd suggest starting in the DeviceTimeline. Filter to the specific device and the 24-hour window before the encryption alert. The key columns are often "ActionType" and "FileName." Look for process creation events (like "ProcessCreated") from unusual locations, such as temporary internet files or user downloads, followed by a chain of file modification events. Don't neglect the "RemoteUrl" column for network connections; a phishing link often leaves a trace there before the payload executes. The Advanced Hunting queries "DeviceFileEvents" and "DeviceProcessEvents" are your best friends here.

Regarding custom detections for a mostly SaaS/Office stack, your focus should be on behavioral patterns, not specific file hashes. Think about creating a detection rule for processes that spawn from Office applications (like winword.exe or outlook.exe) and then perform high-volume file writes with specific extensions. You can also set alerts for large numbers of file modifications in a short time from a single process, which is a hallmark of crypto activity. The built-in custom detection templates are a good starting point, but you'll need to tune them to your environment's normal noise levels.