Agent Foskett Case File • Microsoft Purview • SharePoint Online • DLP • KQL
The Sensitive Document Never Left SharePoint — But Its Contents Did
SharePoint showed no evidence of a file download.
The document remained in its original library.
Yet a confidential pricing table appeared in an external message.
“The file never left SharePoint, Agent Foskett.”
“Wonderful. Did its contents?”
“We're still checking.”
“Then we've only proved the filing cabinet stayed put.” ☕
Case file: The information that escaped without the file
A fictional investigation into document access, copy-and-paste activity, browser uploads, Purview DLP signals and the limits of Microsoft 365 audit evidence.
✓ Distinguish file access from content movement
✓ Correlate Purview and endpoint telemetry
✓ Identify evidence gaps before drawing conclusions
The document was still there
At 09:12 UTC, a finance analyst opened
This is a fictional training investigation. Times, identities and document names are illustrative. Audit event names and available fields depend on licensing, enabled audit and DLP policies, endpoint onboarding, retention and data collection. No single log proves that specific spreadsheet cells were copied.
FY27-Partner-Pricing.xlsx from a restricted SharePoint Online library. At 09:24 UTC, a partner reported receiving a message containing several confidential figures from the workbook. The security team searched for a matching file download and found none.This is a fictional training investigation. Times, identities and document names are illustrative. Audit event names and available fields depend on licensing, enabled audit and DLP policies, endpoint onboarding, retention and data collection. No single log proves that specific spreadsheet cells were copied.
09:12 UTCSharePoint records a file access in the restricted finance library.
09:18 UTCEndpoint telemetry indicates interaction with an external browser destination.
09:24 UTCA partner reports receiving sensitive figures without an attached workbook.
The first mistake: treating “no download” as “no disclosure”
A user can read data in a browser without downloading the underlying file. Information may be retyped, copied, captured in a screenshot, pasted into a chat, submitted to a web form, or accessed through an approved integration. Some of these paths are visible to specific Microsoft Purview Endpoint DLP controls; others are not. SharePoint audit data alone does not reliably reconstruct the text a user viewed or copied.
The investigator must distinguish document access, content extraction and external disclosure. Those are three different claims, requiring different evidence.
The investigator must distinguish document access, content extraction and external disclosure. Those are three different claims, requiring different evidence.
Preserve the evidence before it expires
Record the SharePoint site and file URL, file unique identifier, version history, sensitivity label, user object ID, device ID, UTC window, DLP policy and rule identifiers, and any alert or incident IDs. Preserve the reported external message under an authorised evidence-handling process. Confirm whether Purview Audit, Endpoint DLP and Defender for Endpoint were enabled at the time. Avoid assuming that an empty result means an activity did not happen.
KQL: Reconstruct SharePoint file activity
In Microsoft Sentinel, the
OfficeActivity table is available only when the Microsoft 365 data connector and relevant audit data are ingested. Operation names can vary; inspect your tenant’s actual events first. This query starts broadly with the target document name and projects core audit context. A FileAccessed event indicates an audited access, not which cells were read.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
// Microsoft Sentinel: requires OfficeActivity from Microsoft 365
let startTime = datetime(2026-10-22T09:00:00Z);
let endTime = datetime(2026-10-22T10:00:00Z);
OfficeActivity
| where TimeGenerated between (startTime .. endTime)
| where OfficeWorkload == "SharePoint"
| where SourceFileName =~ "FY27-Partner-Pricing.xlsx"
| project TimeGenerated, Operation, UserId, ClientIP,
OfficeObjectId, Site_Url, SourceFileName, UserAgent
| order by TimeGenerated ascKQL: Inspect Purview DLP activity without inventing a clipboard trail
Microsoft Purview DLP alerts can be exported or integrated into different systems depending on the tenant configuration. In Sentinel environments ingesting Microsoft 365 Defender alerts,
SecurityAlert can provide useful leads. Its alert descriptions and entities are not guaranteed to include copied text, destination URLs or a complete activity record. Investigate the underlying Purview alert in the compliance portal to review supported evidence and matched policy conditions.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
// Microsoft Sentinel: requires DLP-related alerts in SecurityAlert
let startTime = datetime(2026-10-22T08:30:00Z);
let endTime = datetime(2026-10-22T11:00:00Z);
SecurityAlert
| where TimeGenerated between (startTime .. endTime)
| where ProviderName has_any ("Microsoft", "Purview")
or ProductName has_any ("Microsoft", "Purview")
| where AlertName has_any ("DLP", "data loss", "sensitive")
or Description has_any ("DLP", "sensitive information")
| project TimeGenerated, AlertName, ProviderName, ProductName,
AlertSeverity, Description, Entities, SystemAlertId
| order by TimeGenerated ascKQL: Check the endpoint and the destination
If Microsoft Defender for Endpoint is onboarded and the relevant signals are available,
DeviceNetworkEvents can help identify connections from the analyst’s device to a suspicious external service. A network connection does not prove that workbook contents were transmitted. Correlate with browser events, Endpoint DLP activity explorer, proxy logs and authorised destination-side evidence when available.- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
// Microsoft Defender XDR advanced hunting: DeviceNetworkEvents
let startTime = datetime(2026-10-22T09:10:00Z);
let endTime = datetime(2026-10-22T09:30:00Z);
DeviceNetworkEvents
| where Timestamp between (startTime .. endTime)
| where DeviceName =~ "FIN-LT-042"
| where isnotempty(RemoteUrl)
| project Timestamp, DeviceName, InitiatingProcessAccountUpn,
InitiatingProcessFileName, RemoteUrl, RemoteIP,
RemotePort, ActionType
| order by Timestamp ascA DLP alert is a lead, not a verdict
In the fictional case, a Purview alert shows a sensitive information type match during a browser-related action. The analyst checks the policy scope, user, device and target destination. The alert indicates a possible policy-relevant transfer, but investigators must validate its action type and supporting details. A detection can be a true positive, false positive or an event blocked before data left the organisation.
Review whether the relevant DLP policy was in audit-only, warn, block-with-override or block mode at the time. Check whether any override was permitted and recorded. Do not describe a blocked attempt as confirmed exfiltration.
Review whether the relevant DLP policy was in audit-only, warn, block-with-override or block mode at the time. Check whether any override was permitted and recorded. Do not describe a blocked attempt as confirmed exfiltration.
The clue was the matching content, not the missing attachment
The partner’s preserved message contained several unusual pricing figures in the same order as a visible table in the workbook. That supported a content-disclosure hypothesis, but it did not establish the mechanism by itself. The investigation combined the message, the user’s authorised explanation, SharePoint access history, a contemporaneous Endpoint DLP event and destination telemetry. No single event was treated as conclusive.
In this fictional scenario, the user acknowledged pasting a table into an unapproved external collaboration form while trying to speed up a legitimate business task. The resulting exposure was accidental rather than evidence of account compromise. The distinction matters: the control failure and remediation differ.
In this fictional scenario, the user acknowledged pasting a table into an unapproved external collaboration form while trying to speed up a legitimate business task. The resulting exposure was accidental rather than evidence of account compromise. The distinction matters: the control failure and remediation differ.
A six-stage evidence timeline
1. Establish scope: identify the sensitive workbook, its owner, labels, sharing permissions and version.
2. Confirm access: correlate SharePoint audit activity with the authenticated user and device.
3. Inspect DLP: verify the precise policy match, action, enforcement mode and destination context.
4. Review endpoint: examine browser, network and relevant endpoint activity without assuming that a connection equals data transfer.
5. Validate disclosure: compare preserved external content with the source and confirm recipient scope.
6. Document conclusions: separate established facts, plausible inferences and telemetry gaps in the final report.
2. Confirm access: correlate SharePoint audit activity with the authenticated user and device.
3. Inspect DLP: verify the precise policy match, action, enforcement mode and destination context.
4. Review endpoint: examine browser, network and relevant endpoint activity without assuming that a connection equals data transfer.
5. Validate disclosure: compare preserved external content with the source and confirm recipient scope.
6. Document conclusions: separate established facts, plausible inferences and telemetry gaps in the final report.
Containment: protect the information, not just the file
Ask the receiving party to remove the disclosed content under the organisation’s incident-response and legal procedures; verify deletion where feasible and document residual uncertainty. Assess contractual, regulatory and privacy notification obligations. Review SharePoint permissions and sensitivity labels, enforce least privilege, and tune Purview DLP rules for relevant destinations and data types. Where appropriate, use Endpoint DLP controls for supported browser, clipboard and upload scenarios and test them with approved simulations.
Do not simply disable a user or block every external site without evaluating the operational impact and the actual exposure.
Do not simply disable a user or block every external site without evaluating the operational impact and the actual exposure.
Defensive lessons for Microsoft 365 teams
Document residency is not data containment. A file can remain in SharePoint while its information is exposed elsewhere.
Logs have boundaries. SharePoint access events, DLP alerts and endpoint network events each describe different parts of the story.
Policies need testing. Validate sensitivity labels, DLP enforcement, supported browsers and endpoint coverage using realistic scenarios.
Conclusions need evidence. Record what was observed, what was inferred and what cannot be determined.
Logs have boundaries. SharePoint access events, DLP alerts and endpoint network events each describe different parts of the story.
Policies need testing. Validate sensitivity labels, DLP enforcement, supported browsers and endpoint coverage using realistic scenarios.
Conclusions need evidence. Record what was observed, what was inferred and what cannot be determined.
Agent Foskett closes the case
“Good news, Agent Foskett. The document never left SharePoint.”
“I know.”
“So the file is safe?”
“The file is exactly where we left it.”
“And the data?”
Agent Foskett looked at the incident report.
“The data had a meeting without us.” ☕
The Logs Already Knew!
“I know.”
“So the file is safe?”
“The file is exactly where we left it.”
“And the data?”
Agent Foskett looked at the incident report.
“The data had a meeting without us.” ☕
The Logs Already Knew!
Related investigations
The Teams Message Came From a Colleague — But the Link Didn't Belong ThereInvestigate suspicious collaboration links and subsequent identity activity.The Certificate Was Valid — But Nobody Knew Who Was Using ItTrace application access, ownership and workload permissions.The Device Was Compliant Yesterday — Today It Wasn't Even ManagedReview device compliance and access-control evidence.
