Cado Security enables organizations to investigate and respond to potential M365 threats

Cado Security announced that the Cado platform now enables customers to acquire Microsoft 365 Unified Audit Log (UAL) to help investigate and respond to Microsoft 365 compromises such as business email compromise (BEC), account takeover (ATO), and insider threats.

With this new feature, security teams can seamlessly analyze UAL logs alongside other critical sources captured across on-prem and cloud environments.

“With Microsoft 365’s rapid adoption and the ever-increasing amount of critical data being stored on its ecosystems, the rate and scale of attacks should not be surprising,” said James Campbell, CEO of Cado Security. “Overburdened security teams need automated solutions that give them visibility into their organization’s entire environment and enable a proactive response to suspicious activity. Our new collection and analysis support of SaaS environments does just that by providing the much-needed tools to quickly identify, investigate, and respond to threats so organizations can continuously strengthen their security posture and prevent future occurrences.”

Since organizations heavily rely on email for transfer-of-fund requests, BEC is one of the most common and expensive threats to organizations. Attackers employ tactics such as email spoofing and phishing attacks to take over legitimate email accounts and conduct unauthorized money transfers. According to the FBI, BEC cost organizations over $50 billion worldwide between 2013 and 2022.

With Cado’s new feature, customers can automatically import Microsoft 365 Unified Audit Log (UAL) by timeframe, user, IP, or workload so that security teams can investigate and respond to potential M365 threats and gain a deeper understanding of scope and impact using the Cado Security platform.

By investigating UAL events alongside other events, such as forensic artifacts of an affected user’s workstation in a central platform, security teams can rapidly identify the incident’s root cause, whether from a phishing attack or malware infection.

The Cado platform enables organizations to perform rapid incident response with the following key capabilities:

Single-click data capture: Cado enables fully automated or single-click evidence collection across cloud, on-premises, and SaaS environments.

Parallel processing: The Cado platform’s patented cloud-native architecture enables hundreds of data formats to be normalized in minutes.

Automated investigations: (i) Cado AI Investigator, powered by Cado’s local LLM, delivers a high-level summary of an incident and automatically analyzes potentially malicious files; (ii) Automated timeline & root cause analysis, the Cado platform automatically pulls together an entire timeline of events to accelerate path to root cause and remediation; and (iii) Proprietary and third-party threat intelligence is leveraged to automatically flag malicious and suspicious activity so that security teams can quickly pivot their investigation based on critical events.

Single pane of glass: Organizations can better understand the impact of threats with complete visibility across their entire ecosystem. Cado can seamlessly analyze SaaS, cloud, container, serverless, and on-premises assets in a single platform.