Cloud Application Abnormal Data Access Volume Z-Score Anomaly
Builds a 28-day hourly baseline of mail and file access operations (MailItemsAccessed, FileAccessed, FileDownloaded and SearchQueryPerformed) for each application identity and action type in CloudAppEvents, counting hours with no activity as zero, then alerts on each complete hour in the latest window where the identity’s operation count exceeds its average by more than three standard deviations and reaches a minimum volume. Application identities legitimately read data at high volume, so a per-identity statistical baseline separates abuse of granted permissions from normal machine traffic where fixed thresholds fail. Identities with no activity in the baseline period are excluded, and a sustained change in behaviour, such as a large synchronisation or recovery job, will produce one result for each hour it remains elevated. The rule runs every 24 hours, as this is the only Defender custom detection frequency with a 30-day lookback, and tests the 25 complete hours ending two hours before each run, allowing for audit log ingestion delays while overlapping the previous run so that no hour is missed. Where the display name matches the AccountId, Defender for Cloud Apps could not name the identity, which is common for Microsoft first-party services, so analysts should confirm the application before drawing conclusions.
Microsoft Sentinel (KQL)
