CISA shares guidance for Microsoft expanded logging capabilities

​CISA shared guidance for government agencies and enterprises on using expanded cloud logs in their Microsoft 365 tenants as part of their forensic and compliance investigations. As the cybersecurity agency explained, these newly introduced Microsoft Purview Audit (Standard) logging capabilities support enterprise cybersecurity operations by providing access to information on critical events such as mail sent, mail accessed, and user searches in Exchange Online and SharePoint Online. "These capabilities also allow organizations to monitor and analyze thousands of user and admin operations performed in dozens of Microsoft services and solutions," CISA said on Wednesday. "These logs provide new telemetry to enhance threat-hunting capabilities for business email compromise (BEC), advanced nation-state threat activities, and possible insider-risk scenarios," the agency added. The 60-page playbook published today also includes guidance on navigating the expanded logs within Microsoft 365 and ingesting into Microsoft Sentinel and Splunk SIEM (Security Information and Event Management) systems. Microsoft expanded free logging capabilities for all Purview Audit standard customers (with E3/G3 licenses and above) under pressure from CISA after disclosing in July 2023 that a Chinese hacking tracked as Storm-0558 stole emails belonging to senior government officials from the State and Commerce departments in an Exchange Online breach between May and June 2023. The threat actors used a M...