Investigator, API Yourself: Deploying Microsoft Graph on the trail of an attacker

Two clients, two threat hunts – any connection? Using Microsoft’s cloud-security API to parse piles of disparate data leads to fascinating findings