O365 SharePoint search queries for curated M&A/litigation keywords excluding known legal/finance accounts
Detects SharePoint Online search queries involving sensitive keywords related to M&A, legal, or financial activities, excluding authorized personnel in departments such as legal or finance. This rule helps identify potential unauthorized internal reconnaissance or data staging activities within an organization's document management system.
Microsoft Sentinel (KQL)
