# Investigate

When an alert fires—or when a customer calls because a supplier just paid a modified invoice—the main bottleneck in Microsoft 365 and Entra ID is rarely the attacker's sophistication. It is knowing where each piece of evidence actually lives, how identities and session IDs connect across portals, and which logs disappear before anyone even starts looking.

This series builds on the techniques covered in the [attack matrix](../attack-matrix/index.md). Rather than dumping isolated KQL snippets, each article follows the order you investigate an incident on a real tenant: where to open first, how to pivot across log sources, and what blind spots to watch for.

[!ref text="Where are my logs? A field guide to Microsoft 365 & Entra ID log sources"](./where-are-my-logs.md)

## Coming next in this series

* **Business Email Compromise (BEC): end-to-end investigation** — containment order, `MailItemsAccessed` (*Sync* vs *Bind*), hidden inbox rules, and tenant-wide session pivoting.
* **Token theft & AiTM sessions** — telling the victim's legitimate MFA login apart from session replay across interactive sign-ins, non-interactive sign-ins, and Microsoft Graph logs.
* **AI agents: what changes for the defender** — Entra Agent ID patterns, maker credentials, Purview interaction logs, and hunting autonomous agent actions.