---
title: M365 AIR Investigation Signal
description: Identifies Microsoft 365 Automated Investigation and Response (AIR) events including automated investigations, manual investigations, and admin-initiated...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_air_investigation_signal
products:
  - Elastic Security
---

# M365 AIR Investigation Signal
Identifies Microsoft 365 Automated Investigation and Response (AIR) events including automated investigations,
manual investigations, and admin-initiated actions. These events track Microsoft's automated threat response
activities and can indicate active threats being remediated. This building block rule generates security events
for correlation, threat hunting, and telemetry collection to provide visibility into automated response actions.
**Rule type**: query
**Rule indices**:
- logs-o365.audit-*
- filebeat-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://learn.microsoft.com/en-us/defender-office-365/air-about](https://learn.microsoft.com/en-us/defender-office-365/air-about)](https://learn.microsoft.com/en-us/defender-office-365/air-about)
- [[https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#enum-auditlogrecordtype---type-edmint32)

**Tags**:
- Domain: Cloud
- Domain: SaaS
- Data Source: Microsoft 365
- Data Source: Microsoft 365 Audit Logs
- Data Source: Microsoft Defender for Office 365
- Use Case: Threat Detection
- Use Case: Automated Response Tracking
- Tactic: Initial Access
- Tactic: Execution
- Rule Type: BBR
- Rule Type: Custom Query (KQL)
- Platform: Microsoft 365

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).

## Rule Query

```kuery
event.dataset:o365.audit and
    event.code:(AirInvestigation or AirManualInvestigation or AirAdminActionInvestigation)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Initial Access
  - Id: TA0001
  - Reference URL: [[https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)](https://attack.mitre.org/tactics/TA0001/)
- Technique:
  - Name: Phishing
  - Id: T1566
  - Reference URL: [[https://attack.mitre.org/techniques/T1566/](https://attack.mitre.org/techniques/T1566/)](https://attack.mitre.org/techniques/T1566/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: User Execution
  - Id: T1204
  - Reference URL: [[https://attack.mitre.org/techniques/T1204/](https://attack.mitre.org/techniques/T1204/)](https://attack.mitre.org/techniques/T1204/)