Copilot / Enterprise-AI Assistant Mass Retrieval of Sensitivity-Labeled Content
This rule detects potential mass data retrieval or excessive access to sensitive-labeled files by an individual user through Microsoft Copilot within a one-hour window. By monitoring the volume of distinct sensitivity-labeled objects accessed, it identifies behavior consistent with a user or compromised account performing high-volume information gathering.
Microsoft Sentinel (KQL)
