counteractive

incident-response-plan-template

A concise, directive, specific, flexible, and free incident response plan template

o365beat

Elastic Beat for fetching and shipping Office 365 audit events

security-controls

Get-UnifiedAuditLog

Gets events from the Office 365 unified audit log and outputs their details into the pipeline

incident-response-collector

Get-EnhancedWinEvent

Gets events from event logs and event tracing log files on local and remote computers enhances them with details from their XML representation.

scope