Export every record for Eli, with hashes and a manifest.
The audit log keeps 180 days with Audit Standard. An export keeps the evidence for as long as the case needs it. We use export_ual from GitHub with the Graph Audit Search API: what you need first, signing in with MFA, and an export of every record for Eli in the incident window. Then we look at the five files, the manifest that documents the export, verify the hashes, and find the inbox rule in the timeline.
Step through More in Investigation and response
These videos have no narration — the sound is background music and interface clicks. Step through presents the same content as text.