--- title: Optimise your SIEM with the right Microsoft 365 alerts description: Optimise your SIEM with an expert Microsoft 365 solution and improve the reporting of real incidents with relevant alerts on permissions image: https://blog.idecsi.com/hubfs/Blog%20Images/WEBSITE-BLOG-optimiser-SIEM.png --- [![Logo-Idecsi-Black-tagline](https://blog.idecsi.com/hs-fs/hubfs/LOGOS%20IDECSI/LOGOS%20OFFICIELS/Logo-Idecsi-Black-tagline.png?width=1010&height=319&name=Logo-Idecsi-Black-tagline.png)](https://www.idecsi.com/) - Solutions DETOX® pour M365 Audit, Remediation & ROI [Discover DETOX](https://info.idecsi.com/detox-m365?hsLang=en) ![Audit, Remediation & ROI](https://blog.idecsi.com/hubfs/ILLU-4.png) Solutions IDECSI gives security and IT teams full control over their data — across DSPM, Data Access Governance, Human Risk Management, and Data Volume Management. - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) M365 Data Security Platform](https://www.idecsi.com/solution/mydatasecurity/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Data storage optimization](https://www.idecsi.com/solution/mydatamanagement/) - Challenges M365 Checklist 15 Warning Signs Your M365 Data Is at Risk [Get the checklist](https://info.idecsi.com/checklist-15-warningsigns?hsLang=en) ![Checklist risques M365](https://blog.idecsi.com/hubfs/Frame-2147255341.png) Your 2026 Challenges Address your most critical data security and governance challenges - across your M365 environment - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Gain visibility accross M365](https://www.idecsi.com/challenges/visibility-microsoft-365) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Get Ready For Copilot M365](https://www.idecsi.com/challenges/m365-copilot/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Control external user access](https://www.idecsi.com/challenges/external-access-microsoft-365/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Prevent Sensitive Data Exposure](https://www.idecsi.com/challenges/sensitive-data-m365/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Gain visibility across Microsoft 365](https://www.idecsi.com/challenges/visibility-microsoft-365/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Ensure regulatory compliance](https://www.idecsi.com/challenges/compliance-m365/) - Resources Is Your Tenant Ready for Copilot? A Security & Governance Playbook [Download](https://info.idecsi.com/whitepapper_copilot?hsLang=en) ![Copilot guide](https://blog.idecsi.com/hubfs/Frame-2147255339.png) Our resources Check out our useful resources for improving data protection - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Blog](https://blog.idecsi.com) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Help Center](https://help.idecsi.com/) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) Ressources & News](https://blog.idecsi.com/resources?hsLang=en) - [![download\_done](https://blog.idecsi.com/hubfs/download_done.svg) About us](https://www.idecsi.com/about-us/) - [Customers](https://blog.idecsi.com/resources-customer?hsLang=en) - - [English](https://blog.idecsi.com/optimise-siem-office365-alerts) - [Français](https://blog.idecsi.com/fr/enrichir-siem-alertes-microsoft365) Search [Request a demo](https://info.idecsi.com/demo-idecsi?hsLang=en) Microsoft 365 06 June 2019 # Optimise your SIEM with the right alerts on Microsoft 365 ![Illustration of SIEM](https://f.hubspotusercontent40.net/hubfs/4272098/Blog%20Images/WEBSITE-BLOG-optimiser-SIEM.png) - [Home](https://www.idecsi.com/) - [Blog](https://blog.idecsi.com) - Optimise your SIEM with the right alerts on Microsoft 365 In this age of cloud and collaboration, fighting the digital threat demands a high budget. Tools such as the Office 365 suite, combined with new user behaviours, put additional pressure on CISOs and security teams by forcing them to manage an impossible and ever increasing amount of data. ## The risks associated with Microsoft 365 The strength of collaboration tools is simultaneously their security weakness. The paradox is such that exploiting the tools to their maximum encourages actions that can jeopardize security: broad access to files or mailboxes, configuration changes, creation of automatic rules (such as email transfer), updated permissions, and much more.  The risks for the company are real, often invisible and frequently complex for security teams, from   - an **external intrusion** into the platform via email fraud or a phishing campaign - an **internal employee** **abusing** **rights** (accessing confidential files, unauthorised access to a mailbox) - or **sharing between different users and groups**. Share, synchronise, access, configure,... so many common place operations performed daily by hundreds and thousands of employees. **How can your security tools or SIEM** **quickly identify the real threats?**  ## Classify alerts according to the level of risk It is critical to know where the vulnerabilities are located, in order to report the "right alerts". The level of risk is related to several factors:   - The **user’s** behaviour, their different permissions, their way of working and habits (business travel, assistant, smartphone, …). - The **content of the resources** – more or less sensitive, confidential data - **Applications** such as SharePoint, Messaging, OneDrive, and Microsoft Teams have many sophisticated features and settings. Some actions have a global impact (e.g. message flow rules). It’s necessary to identify potentially dangerous actions when they happen. To identify the right alerts in their SIEM, IDECSI allows security managers to manage Office 365 risks based on   - their internal needs - the use cases provided by IDECSI's expertise. ## Focus on "high-risk alerts" The IDECSI platform acts as an Office 365 preprocessor to the SIEM, based on expert knowledge of Office 365 and its applications.  IDECSI alerts as soon as suspicious or potentially dangerous behaviour is detected (new access, change of configuration, suspicious sharing, etc.).  For highly accurate and personalised detection, IDECSI establishes a profile for the normal use of the protected resource, through an automated learning phase.  IDECSI's technology correlates all relevant factors to assess risk: the user’s normal behaviour, the action taken, its context (geolocation, schedule, connection protocol, etc.), and the application concerned (what could the impact be?). Thanks to automatic learning and personalized protection, only genuine issues are alerted and reported to the security team – in real time.  ## MyDataSecurity [MyDataSecurity dashboard](https://www.idecsi.com/solution/mydatasecurity/) is a component of the IDECSI platform, it acts as a Personal SIEM. Each user can view, through a mobile or web interface, the list of people who access their resources (inbox, libraries,...) or who have the rights to access them. If the alerting function is activated, the user will be able to receive notifications of suspicious behaviour, (as configured by the security team). The user can indicate if the alert is a breach or instead corresponds to a new acceptable use case. In the case of a legitimate operation, the user’s profile is automatically updated. In the case of a breach, the information is immediately forwarded to the security team. This reduces false positives, allows constructive communication with the user and efficient event management.  ### **Safety, efficiency and profitability** This approach allows security managers to monitor the entire Office 365 estate while optimising the management of daily events and risks. ![SIEM optimized data protection](https://blog.idecsi.com/hs-fs/hubfs/SIEM%20optimized%20data%20protection.png?width=1040&name=SIEM%20optimized%20data%20protection.png) IDECSI collects and analyses logs without ever having access to the email or document content. The platform provides the most relevant and reliable information, which can be directly qualified by the user, ensuring that the security team only processes events relating to real issues. Recent articles [Microsoft Scout and M365 Security: Access Risks to Anticipate](https://blog.idecsi.com/microsoft-scout-security-data-access-m365?hsLang=en) [Sensitive Data in Microsoft 365: How to Identify Risks and Regain Control](https://blog.idecsi.com/fr/sensitive-data-microsoft-365?hsLang=en) [Microsoft 365 SharePoint Storage Costs in 2026: What's Changing](https://blog.idecsi.com/microsoft-365-sharepoint-storage-costs-2026?hsLang=en) [Zero Trust Data Governance for Microsoft 365: CISO Guide](https://blog.idecsi.com/zero-trust-data-governance-microsoft-365?hsLang=en) Best practices to improve Microsoft Teams security [![Download the infographic ](https://no-cache.hubspot.com/cta/default/4272098/825ad7d1-e961-4a7a-a6b3-6e380b22285f.png)](https://cta-redirect.hubspot.com/cta/redirect/4272098/825ad7d1-e961-4a7a-a6b3-6e380b22285f) Share this article Subscribe to our newsletter and receive new contents every month Our articles These articles may interest you ![](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/Co%C3%BBt%20du%20stockage%20Microsoft%20365%20en%202026.png) Microsoft 365 Microsoft 365 SharePoint Storage Costs in 2026: What's Changing [Lire l'article](https://blog.idecsi.com/microsoft-365-sharepoint-storage-costs-2026?hsLang=en) ![](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/Microsoft%20Foundry%20_%20guide%20complet%20et%20enjeux%20pour%20la%20s%C3%A9curit%C3%A9%20%282026%29.png) Microsoft 365 Security Microsoft Foundry: Complete Guide and Data Security Implications (2026) [Lire l'article](https://blog.idecsi.com/microsoft-foundry-guide-security?hsLang=en) ![](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/Illus-Blog-Supervision.png) Microsoft 365 Security Microsoft 365 Phishing: Why Oversharing Makes a Compromised Account Far More Dangerous [Lire l'article](https://blog.idecsi.com/fr/phishing-microsoft-365-risques-donnees-partagees-1?hsLang=en) ![](https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/image%20%2858%29.png) Microsoft 365 Security Securing AI Agents in Microsoft 365: Best Practices for 2026 [Lire l'article](https://blog.idecsi.com/securing-ai-agents-microsoft-365?hsLang=en) ### Data protection, let's discuss your project?   [![Contact us](https://no-cache.hubspot.com/cta/default/4272098/bea4f372-c84f-4ec4-980c-ca663747fbfe.png)](https://cta-redirect.hubspot.com/cta/redirect/4272098/bea4f372-c84f-4ec4-980c-ca663747fbfe) ![video background](https://idecsi2a-dev-idecsi.pf27.wpserveur.net/wp-content/uploads/2022/02/video-background-idecsi-responsive-1.png) [![Logo-Idecsi-White-Ss-ES](https://blog.idecsi.com/hubfs/LOGOS%20IDECSI/LOGOS%20OFFICIELS/Logo-Idecsi-White-Ss-ES.svg)](https://www.idecsi.com/) +33 1 84 79 38 30 - - - - [Why choose IDECSI?](https://www.idecsi.com/user-security/) - [About us](https://www.idecsi.com/about-us/) - [Join the team](https://www.welcometothejungle.com/fr/companies/idecsi) - Solutions - [Visibility](https://www.idecsi.com/challenge-data-visibility/) - [Detection](https://www.idecsi.com/challenge-threat-detection/) - [User engagement](https://www.idecsi.com/challenge-involve-user/) - [Access review](https://www.idecsi.com/challenge-rights-review/) - [Remediation](https://www.idecsi.com/challenge-remediation/) - [Sensitive data](https://www.idecsi.com/challenge-sensitive-data/) - [Products](https://www.idecsi.com/solution/) - [MyDataSecurity](https://www.idecsi.com/solution/mydatasecurity/) - [Advanced Monitoring](https://www.idecsi.com/solution/advanced-monitoring/) - [MyDataManagement](https://www.idecsi.com/solution/mydatamanagement/) - Resources - [Resources & News](https://blog.idecsi.com/resources?hsLang=en) - [Blog](https://blog.idecsi.com) - [Customer success](https://blog.idecsi.com/resources-customer?hsLang=en) - [Extranet](https://extranet.idecsi.com?hsLang=en) © IDECSI ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mona Piquet", "url" : "https://blog.idecsi.com/author/mona-piquet" }, "dateModified" : "2022-03-07T13:54:04.648Z", "datePublished" : "2019-06-06T12:08:00.000Z", "headline" : "Optimise your SIEM with the right Microsoft 365 alerts", "image" : [ "https://blog.idecsi.com/hubfs/Blog%20Images/WEBSITE-BLOG-optimiser-SIEM.png" ], "mainEntityOfPage" : { "@id" : "https://blog.idecsi.com/optimise-siem-office365-alerts", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.idecsi.com/hubfs/Logo-Idecsi-Black-tagline.png" }, "name" : "IDECSI" } } ```