Detection rules › By event

M365-SharePointSharingOperation

Event	Rules
AnonymousLinkCreated	2
AnonymousLinkUpdated	1
AnonymousLinkUsed	1
SiteCollectionAdminAdded	1

AnonymousLinkCreated

2 detection rules reference this event. View event page.

YARA-L (1)

O365 OneDrive Anonymous Link Created or Updated severity medium

Panther (1)

Microsoft365 External Document Sharing severity low T1039

AnonymousLinkUpdated

1 detection rules reference this event. View event page.

YARA-L (1)

O365 OneDrive Anonymous Link Created or Updated severity medium

AnonymousLinkUsed

1 detection rules reference this event. View event page.

YARA-L (1)

O365 OneDrive Anonymous Link Accessed severity medium T1048, T1048.002

SiteCollectionAdminAdded

1 detection rules reference this event. View event page.

Elastic (1)

M365 SharePoint Site Administrator Added severity medium T1098, T1098.003