Microsoft Cloud App Security: The Hunt for Insider Risk

Great question Dean_Gross 

I would say that these examples provide great follow-up customized queries that can be used in addition to the detail you would get based on policy matches in the Insider Risk Management utility.  Please see here for the total list of indicators that Insider Risk Management is currently using: https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management-settings?view=o365-worldwide#indicators.  The Insider Risk Management tool can help proactively alert and manage the workflow through investigating an individual that has triggered an Insider Risk Policy.  In the investigation above you very well may have been alerted to Mass Download signals and Device activity through copying files to a USB Drive.