I have been using Cloud App Security for a few months now and overall I have found it very useful. It gives a very good level of visibility into O365 and the Alerting is useful too. Good work - thank you.
I do find it difficult to find the correct MS documentation though. Is there a list of all the EVENT_CATEGORY_* types? E.g. EVENT_CATEGORY_LOGIN, EVENT_CATEGORY_UPDATE_USER, EVENT_CATEGORY_SET_FORWARDING_MAILBOX etc.