Alerts | Stephen Hackers Blog

22/06/2020

Microsoft Azure Security – Study Notes

By Steve inAdvisor, Alerts, Alerts, App Service, Azure AD, Azure Container Registry, Azure Monitor, Azure Security, Blueprint, Cloud & Datacenter Management, Cloud Security, Conditional Access, Content Trust, Cyber Security, Enterprise Security, Enterprise Security, Externsions, Hot Wired IT Solutions, IAM, Identity Protection, Key Vault, Kubernetes, Logs, Management Locks, Microsoft, Microsoft Azure, Networks, Powershell, Roles, Users and Groups, Security & Compliance, Security Center, Storage Tag AZ-500, AZ500, Azure, Azure Security, Exam, Microsoft, Microsoft Azure Security Technologies, Prep, Study Notes

A collection of all my study notes and lab work while working towards passing the badge Microsoft Certified Security Engineer Associate by passing the AZ-500 exam

These notes are in no order and are not focused towards any exam content other than sharing my experience of configuring and automating security within Azure in the run up to the final exam.

15/06/2020

Office 365 Security and Compliance – Alert When A Specific File Is Accessed

By Steve inAlerts, Alerts, Azure Security, Cloud & Datacenter Management, Enterprise Security, Logs, Microsoft, Microsoft Azure, Office 365, Office Apps & Services, OneDrive, Security & Compliance, Security & Compliance, Security Center Tag Actions, Active, Alert, Alerts, Azure Security, Dismissed, File, File Accessed, File Activity, File Modified, File Opened, Information Governance, Investigating, Investigation, Microsoft 365, Monitor, Notifications, Office365, Resolved, Security And Compliance

When a very important file stored in OneDrive needs to be monitored. This is how to create an alert on file activity. We specifically want to monitor and alert on any activity done to the specific file by any user.

This example file is called HR.doc and is stored in OneDrive.

This is how we created an alert policy for file activity of the file “HR.doc”.

Open Office 365 Security & Compliance

https://protection.office.com/alertpolicies

Alerts > Alert Policies > New Policy

Options selected

Status – Enabled
Severity – Medium
Category – Information Governance
Conditions – Activity is File Activity and File name is HR.doc
Scope – All Users
Email Recipients – email address
Limit the number of notifications – optional. 5 in this example

Test the alert by trying to modify or access the file.

Result

Alert email notification as shown below.

This logs an alert which then should be reviewed and investigated

Action the Alert

15/06/2020

Content Search – Security And Compliance – Search A Mailbox For Specific Content And Then Export Results

By Steve inAlerts, Alerts, Azure Security, Cloud & Datacenter Management, Enterprise Security, Exchange, Logs, Microsoft, Microsoft Azure, Office 365, Office Apps & Services, Security & Compliance, Security & Compliance, Security Center Tag Azure Security, Compliance, Compliance.microsoft, Content Search, Export, Investigation, Mailbox, New Search, Search, Security, Security And Compliance, specific word

If you’re doing some compliance investigation work, you may need to search a user’s mailbox for specific words.

This is how To Search Email Content in Office 365 Security & Compliance for a specific user which sent email containing a specific word then export results.

Reference guides – Content search

Microsoft Docs Content Search

Microsoft Docs Export Search

Content Search : How to search a mailbox for specific keywords and export the data

Mircosoft 365 Admin Center -> Compliance Admin Center

Content Search > + New Search

New Search > Keywords “Blog” example > Specific Locations > Modify > Choose Users, Groups or Teams

Enter users name > Select > Choose

Done > Save > Save & Run > Save Search

This search will trigger a default alert email to be sent out

Next step, Export the results

Unable to preview results problem or export?

If you cannot preview, you need to add a role to the user account, eDiscovery Administrator role (Example) or eDiscovery Manager for specific cases / Compliance Admin / Compliance Data Administrator