M365 Unified Audit Log Investigation

Hard Microsoft SC-200 cybersecurity drill: You are an Incident Responder at Meridian Financial. A high-value executive account was briefly compromised