jevusecases.work

Use case demo

M365 audit log review

Synthetic audit events scored for unusualness with Noul privilege and mass-download patterns. Route access risk to a SOC queue.

Synthetic demo Proposed design
Shared mailbox · service desk Synthetic demo Proposed design
Inbox · synthetic items
    RulesPolicy in code
    JevChoice · Score · Noul
    Frontier LLMDraft only
    HumanAccountable action
    Inputs

    Select a message.

    Jev + rules

    Judgments appear here.

    Outputs

    Tickets, drafts, queues.

    Pilot card

    What a first pilot of this decision needs. Proposed design, not a measured result.

    DecisionWhich audit events should an analyst look at today?
    State Jev seesEvent type, actor, target, time, actor's normal pattern summary.
    Questions
    • Score How unusual is the event for this actor (1–5)?
    • Noul Does it fit a privilege-escalation pattern?
    • Noul Does it fit a mass-download pattern?
    First action code may takeQueue the event for the SOC with the pattern flags.
    Stays with a personDisabling accounts, removing rights, any containment.
    Measure firstAnalyst-confirmed findings per hundred flags; time from event to triage.
    Microsoft surfacePurview audit export or Sentinel table; adapter; Sentinel incident or SOC queue.
    Out of scopeAutomated containment.