Office 365 Email Bulk Download via Graph API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects a high volume of HTTP requests to graph.microsoft.com with the URI containing '/messages', indicating a potential bulk download of emails from Office 365 via the Graph API. The threshold is set to 30 requests within 60 seconds from a single source IP.