Detection rules › Elastic
M365 AIR Investigation Signal
Identifies Microsoft 365 Automated Investigation and Response (AIR) events including automated investigations, manual investigations, and admin-initiated actions. These events track Microsoft's automated threat response activities and can indicate active threats being remediated. This building block rule generates security events for correlation, threat hunting, and telemetry collection to provide visibility into automated response actions.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1566 Phishing |
| Execution | T1204 User Execution |
Event coverage
Rule body elastic
[metadata]
bypass_bbr_timing = true
creation_date = "2026/02/20"
integration = ["o365"]
maturity = "production"
updated_date = "2026/02/20"
[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Identifies Microsoft 365 Automated Investigation and Response (AIR) events including automated investigations,
manual investigations, and admin-initiated actions. These events track Microsoft's automated threat response
activities and can indicate active threats being remediated. This building block rule generates security events
for correlation, threat hunting, and telemetry collection to provide visibility into automated response actions.
"""
from = "now-9m"
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 AIR Investigation Signal"
references = [
"https://learn.microsoft.com/en-us/defender-office-365/air-about",
"https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32",
]
risk_score = 21
rule_id = "7ab5b02c-0026-4c71-b523-dd1e97e15477"
setup = """### Additional notes
For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "low"
tags = [
"Domain: Cloud",
"Domain: SaaS",
"Data Source: Microsoft 365",
"Data Source: Microsoft 365 Audit Logs",
"Data Source: Microsoft Defender for Office 365",
"Use Case: Threat Detection",
"Use Case: Automated Response Tracking",
"Tactic: Initial Access",
"Tactic: Execution",
"Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "query"
query = '''
event.dataset:o365.audit and
event.code:(AirInvestigation or AirManualInvestigation or AirAdminActionInvestigation)
'''
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
Stages and Predicates
Stage 1: query
event.dataset:o365.audit and
event.code:(AirInvestigation or AirManualInvestigation or AirAdminActionInvestigation)
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
event.code | in |
|
event.dataset | eq |
|