SharePoint SearchQueryPerformed enumeration via STS_Site/STS_Web indexdocid pagi
Detects high-volume or systematic SharePoint search queries performed by a single user, specifically looking for indicators of data discovery activities such as searching for SharePoint sites, web structures, or iterating through document IDs which may suggest an adversary attempting to map or identify sensitive data within the environment.
Microsoft Sentinel (KQL)
