M365 Purview Security Compliance Signal

[metadata]
bypass_bbr_timing = true
creation_date = "2026/02/04"
integration = ["o365"]
maturity = "production"
updated_date = "2026/02/20"

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Collects alerts generated by Microsoft Purview (formerly Office 365 Security & Compliance Center) through the
SecurityComplianceCenter provider. These alerts represent policy violations, compliance issues, and threats detected by
Microsoft Purview's built-in detection capabilities including DLP policy matches, eDiscovery actions, retention policy
violations, and other compliance-related events. This building block rule generates security events for correlation,
threat hunting, and telemetry collection without creating standalone alerts, reducing alert fatigue while maintaining
comprehensive visibility into Microsoft Purview's compliance and security detections.
"""
from = "now-9m"
index = ["logs-o365.audit-*", "filebeat-*"]
language = "kuery"
license = "Elastic License v2"
name = "M365 Purview Security Compliance Signal"
references = [
    "https://learn.microsoft.com/en-us/purview/audit-log-activities",
    "https://learn.microsoft.com/en-us/purview/audit-solutions-overview",
]
risk_score = 21
rule_id = "a7e9e2e8-3c5d-4b9a-8e7f-1a2b3c4d5e6f"
setup = """### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).
"""
severity = "low"
tags = [
    "Domain: Cloud",
    "Domain: SaaS",
    "Data Source: Microsoft 365",
    "Data Source: Microsoft 365 Audit Logs",
    "Data Source: Microsoft Purview",
    "Use Case: Threat Detection",
    "Use Case: Compliance Monitoring",
    "Tactic: Initial Access",
    "Tactic: Credential Access",
    "Tactic: Collection",
    "Tactic: Exfiltration",
    "Tactic: Impact",
    "Rule Type: BBR",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.code:SecurityComplianceAlerts
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0040"
name = "Impact"
reference = "https://attack.mitre.org/tactics/TA0040/"