drop m365 unified audit log csv or json export · parse all audit events across exchange sharepoint teams onedrive and azure ad · surface suspicious operations privilege changes and data access events · reconstruct user activity timeline · runs locally
unified audit log
drop UAL JSON or CSV
compliance center export · search-unifiedauditlog · multiple files ok
record types resolved via m365 record type database · data-driven risk
drop m365 unified audit log csv or json