UBA : Sharing Policy Changed or Shared External (SharePoint/OneDrive)

The QRadar® User Behavior Analytics (UBA) app supports use cases based on rules for certain behavioral anomalies.

UBA : Sharing Policy Changed or Shared External (SharePoint/OneDrive)

Enabled by default

False

Default senseValue

15

Description

Detects when an item's sharing policy is changed to share with a guest user.

Support rule

BB:UBA : Common Event Filters

Log source types

Microsoft Office 365 (EventID: ExternalSharingSet, SharingPolicyChanged)