AN1565
Analytic 1565
SaaS
Atypical access to Slack or Teams conversations via APIs, automation tokens, or bulk message export functionality, particularly after an account takeover or rare sign-in pattern. Often includes mass retrieval of chat history, download of message content, or scraping of workspace/channel metadata.
saas:slack
conversations.history, files.list, users.info, audit_logs
m365:signinlogs
UserLoggedIn
[TimeWindow]
Time interval to observe post-login message scraping behavior
[MessageExportThreshold]
Number of messages or files accessed/downloaded to flag for review
[UserContext]
User privilege level, team membership, or role context to suppress false positives
[AccessMethod]
Direct user access vs API token, OAuth app, or bot interaction
AN1566
Analytic 1566
Office Suite
Suspicious access to Microsoft Teams chat messages via eDiscovery, Graph API, or export methods after rare or compromised sign-in. Often associated with excessive file access, sensitive content review, or anomaly from expected user behavior.
m365:unified
TeamsMessagesAccessedViaEDiscovery, TeamsGraphMessageExport
m365:signinlogs
UserLoggedIn
[UserRole]
Whether user is part of InfoSec, Legal, or expected to use Teams eDiscovery tools
[GeoRiskScore]
Unusual country/IP sign-in patterns prior to Teams data export
[AccessVolume]
Message or file threshold for triggering alert