Before
Security staff likely had to review incoming Exchange audit events manually, separate system-generated activity from real-user actions, and inspect relevant mailbox details one event at a time. They also had to find the appropriate team channel, prepare the incident summary, post it, and coordinate the next response step.
How it works
- Receive the audit payload, validate the user, and filter the event stream to relevant operations.
- Process each qualifying event, extract mailbox and forwarding details, and retrieve related messages for context.
- Generate and post an interactive incident alert in the target Teams channel, leaving the final response choice to the responsible team.
Workflow details
- Event intake and user validation: The workflow starts when a TLS-protected webhook receives the full audit-event payload from a monitoring flow. It checks that the activity belongs to a real user and excludes known system identities before continuing.
- Relevant-event filtering: The flow keeps only selected operations, including message sending, moving messages to deleted items, new inbox-rule creation, and mailbox changes. For forwarding-related activity, it checks forwarding parameters against the configured organizational domain and extracts the relevant rule or address details.
- Context collection: Each qualifying event is processed individually. The workflow extracts details such as the user, subject, recipient, send time, forwarding information, and rule creation time, then retrieves messages associated with the affected user and subject when applicable.
- Alert analysis and formatting: An AI step converts the collected information into a structured incident summary, creating a concise heading, event-by-event details, event counts, recipients, subjects, and timestamps while omitting empty or irrelevant content.
- Interactive incident delivery: The workflow identifies the target team and channel, then posts the contextualized incident ticket as an Adaptive Card. The alert includes human-selected follow-up options to lock the account, ask the user about the activity, or close the alert.
What changed
Qualifying Exchange activity is now filtered, enriched, summarized, and delivered to the target Teams channel automatically as soon as the audit payload arrives. The security team receives consistent event context and can choose the next step directly from the alert instead of manually preparing the handoff.
Work removed
Reviewing events one by one, excluding system activity, checking operation and forwarding conditions, extracting subjects, recipients, dates, users, and rule details, retrieving related messages, finding the target channel, composing the incident summary, and manually posting the alert.
Expected outcome
A reasonable conservative estimate is that at least four recurring manual actions are avoided for each qualifying event, while account locking, user outreach, or alert closure remains an explicit human-selected decision.
