I've been working on tightening up our internal security monitoring, and one area that always felt a bit opaque was user behavior on our SharePoint document libraries. Specifically, spotting anomalous bulk downloads by a single user—potential data exfiltration or just a user being overzealous.
Microsoft Sentinel is great for this, but setting up a precise alert took a bit of tinkering. Here's a streamlined method I landed on that focuses on high-volume download events within a short time window.
**Core Logic & Prerequisites:**
First, ensure your SharePoint Online logs are flowing into Sentinel via the Office 365 connector. The key table is `OfficeActivity`. We're looking for `Operation` equals `FileDownloaded` and the `SourceFileName` isn't empty.
The KQL query below looks for users who have triggered more than a threshold of download events from a specific site within a 10-minute window. You'll need to adjust two variables:
* `download_threshold`: I started with 20 files as a baseline.
* `workspace_name`: Your Sentinel workspace.
**The KQL Query:**
```kusto
let download_threshold = 20;
let timeframe = 10m;
OfficeActivity
| where TimeGenerated >= ago(timeframe)
| where OfficeWorkload == "SharePoint"
| where Operation == "FileDownloaded"
| where isnotempty(SourceFileName)
| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated), DownloadedFiles = count(), FileList = make_set(SourceFileName) by UserId, SiteUrl, UserAgent
| where DownloadedFiles > download_threshold
| extend CustomEntity = pack("UserId", UserId, "SiteUrl", SiteUrl, "Count", DownloadedFiles)
| project StartTime, EndTime, UserId, SiteUrl, DownloadedFiles, UserAgent, FileList, CustomEntity
```
**Next Steps After the Analytics Rule:**
Once you save this as a scheduled analytics rule (every 5-10 minutes works), you'll want to:
* Create a clear incident classification in the rule settings.
* Consider adding an exclusion for known administrative or backup accounts.
* Integrate the alert with your ticketing system or Teams channel for immediate visibility.
The real power comes from tuning the threshold based on your normal department activity and pairing this alert with user context from your Azure AD logs. Have any of you implemented similar detection for other O365 workloads like OneDrive or Teams file sharing? I'm curious about your thresholds and if you've tied this into a user risk scoring model.