Forum Discussion

MikeP751860's avatar
MikeP751860
Brass Contributor
Sep 27, 2023

OfficeActivity - Rare and potentially high-risk Office operations and automation

Hi,   We are receiving a number of "OfficeActivity - Rare and potentially high-risk Office operations" alerts for users who are setting up mailbox GrantSendOnBehaveOf and creating mail moving rules...
automation
siem
soar
Monkey_D_Luffy's avatar
Monkey_D_Luffy
Copper Contributor
Nov 11, 2023

MikeP751860 Hi did you get to finetune this alert. Can you please share your insights on this

  • MikeP751860's avatar
    MikeP751860
    Brass Contributor
    Nov 13, 2023
    Monkey_D_Luffy No tuned it yet but when I do I'm adding NT AUTHORITY\\SYSTEM (Microsoft.Exchange.AdminApi.NetCore) to be filtered out as we are getting events from the account.

Resources