SharePoint Online API enumeration of sites/subsites via SearchQueryPerformed
Detects a user performing a high volume of SharePoint site discovery queries within a one-hour window. This behavior often indicates an adversary attempting to map site structures and discover content across an organization's SharePoint environment.
Microsoft Sentinel (KQL)
