User agent : ODMTADemand-Transform_Zip

Hi, I would treat this as "likely Microsoft service activity, but verify before closing the alert."

The `Transform_Zip` wording strongly suggests a SharePoint/OneDrive backend operation related to packaging files for download, similar to other ZIP-generation user agents people have seen. That said, if `ODMTADemand-Transform_Zip` is not publicly documented, I would not mark it as benign based only on the name.

I would correlate the timestamp with Unified Audit Log entries such as file download, folder download, or sharing activity. Check the user, site URL, source IP, app ID if present, and request/correlation ID. If it lines up with a user downloading multiple files as a ZIP and the IP/actor context is Microsoft/SharePoint expected behavior, it is probably normal. If the actor, location, or file scope does not match, keep investigating and open a Microsoft support case for confirmation.