Automated SharePoint/OneDrive/Exchange discovery via bulk search enumeration
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Microsoft Sentinel (KQL)
