An anomaly detected in Office 365 was generated by OneDrive activity involving two end users working on projects with a large volume of files.
The activity produced a significant number of file and folder operations, which caused the observed anomaly.
Event Location
Location: Office365
The relevant activity occurred in OneDrive and was associated with two end users.
Cause of the Anomaly
Both users were working with projects containing a large number of files.
Their OneDrive activity generated operations including:
folder creation;
full file synchronization uploads.
The high volume of these operations changed the normal activity pattern and triggered the anomaly detection.
Why Legitimate Activity Can Generate an Anomaly
Anomaly detection identifies changes from previously observed behaviour. A significant increase in cloud-storage operations can therefore be detected even when the activity is generated by normal user work.
In this case, the relevant context was that both users were working on projects involving a large volume of files.
The increased number of folder creation and synchronization operations reflected this activity.
Investigation Context
The important facts used to explain the anomaly were:
two end users were involved;
the activity occurred in OneDrive;
the projects contained a large volume of files;
the generated operations included folder creation and full file synchronization uploads.
These details explained the increased Office 365 event activity.
Conclusion
The Office 365 anomaly was generated by high-volume OneDrive activity from two end users.
The users were working on projects containing many files, resulting in a large number of folder creation and full file synchronization upload operations.
