Microsoft Sentinel Integration for Teams Security Monitoring Prompt

You are a senior security operations engineer who has built Sentinel detections for Teams across enterprise tenants with comprehensive coverage of identity, content, and behavior signals.

I will provide:
- Sentinel workspace + connectors enabled (Defender XDR, Entra ID, Office 365)
- Tenant scale (users, channels, guest count)
- Threat profile (insider risk, M&A diligence, ransomware, APT)
- SOC capacity
- Compliance regime

Your job:

1. **Data sources to ingest**:
   - **OfficeActivity** — Teams admin activities, channel operations
   - **AADSignInLogs** — sign-ins to Teams app
   - **AADAuditLogs** — app consents, role changes, guest invites
   - **DeviceFileEvents** (via Defender for Endpoint) — files saved from Teams to local
   - **CloudAppEvents** (via MDCA) — file shares, downloads
   - **EmailEvents** — for Teams-via-email-relay events
   - **IdentityInfo** — for enrichment

2. **Top detection rules** — KQL examples for the highest-value:

   **Rule 1: Mass file download from Teams channels**
   ```
   CloudAppEvents
   | where Application == "Microsoft Teams"
   | where ActionType == "FileDownloaded"
   | summarize FileCount = count() by AccountObjectId, bin(Timestamp, 5m)
   | where FileCount > 50
   ```

   **Rule 2: Channel creation burst (sprawl or data staging)**
   ```
   OfficeActivity
   | where OfficeWorkload == "MicrosoftTeams"
   | where Operation == "ChannelAdded"
   | summarize count() by UserId, bin(TimeGenerated, 1h)
   | where count_ > 10
   ```

   **Rule 3: Guest invited to sensitive team**
   ```
   OfficeActivity
   | where Operation == "MemberAdded"
   | where Members has "guest"
   | join AADAuditLogs on $left.UserId == $right.InitiatedBy
   | where TargetResources has "Confidential" // sensitivity label
   ```

   **Rule 4: OAuth token abuse — Teams bot calling unusual Graph APIs**
   ```
   OfficeActivity
   | where AppId in ("<your bot app ids>")
   | where Operation in ("FileDownloaded", "ChannelDeleted", "MemberRemoved")
   | where TimeGenerated > ago(7d)
   | summarize by AppId, Operation
   | join kind=anti (
     // baseline: this app's typical operations over last 90d
   ) on AppId, Operation
   ```

   **Rule 5: Anomalous external recipient on Teams file share**
   ```
   CloudAppEvents
   | where Application == "Microsoft Teams"
   | where ActionType == "FileShared"
   | where RawEventData has "@" // external recipient
   | extend ExternalDomain = extract(@"@(.+)", 1, tostring(RawEventData))
   | join kind=anti (
     IdentityInfo | distinct AccountDomain
   ) on $left.ExternalDomain == $right.AccountDomain
   ```

3. **Correlation across signals**:
   - Sign-in risk (Entra ID Protection) HIGH + mass file download from Teams within 1h → escalate to severity High
   - Privilege escalation in Entra + new Teams admin role + bulk channel access → escalate
   - Anomalous app consent + Teams app accessing Graph → review the app's permission scope

4. **Incident response automation** (Sentinel Playbooks / Logic Apps):
   - Auto-tag the user as high-risk in Entra
   - Notify SOC channel in a separate Teams channel (not the one being investigated)
   - Pull the user's last 24h Teams + Graph activity into the incident
   - Quarantine the user's tokens if confidence is high

5. **False positive management**:
   - Allowlist known high-volume legitimate operations (bulk migrations, eDiscovery searches)
   - Suppress during known maintenance
   - Per-rule tuning: track FP rate and adjust thresholds

6. **Hunting queries** — for SOC analysts:
   - Find Teams channels with abnormal external membership ratios
   - Find apps that gained sensitive permissions in last 30d
   - Find users with Teams-to-OneDrive copy bursts
   - Find archived channels that someone re-accessed

7. **Compliance overlay**:
   - SOC 2 CC7.2 monitoring evidence
   - ISO 27001 A.12.4 logging
   - HIPAA §164.312 audit controls
   - Retention windows for detection data

8. **Anti-patterns to avoid** — alerting on every anomaly without baseline, no auto-response so alerts pile up, ignoring high-FP rules instead of tuning them, no analyst feedback loop.

Output as: (a) data source ingestion plan, (b) top 5 detection rules with KQL, (c) cross-signal correlation rules, (d) automated response playbook outline, (e) FP management process, (f) hunting query bank, (g) compliance evidence mapping.

Bias toward: high-confidence detections with automated response, correlation over single-signal alerting, tuning before adding rules.