Eli is phished. What to do first, and why the order matters.
A customer asks about Eli's new bank details, and Eli never sent that invoice. We go through the order of a response: lock the attacker out, export the logs that expire first, find the way in with Microsoft Entra, see what happened inside with Purview, work out who and what was affected, and check which reporting duties apply. The logs run on different clocks, so the order matters.
Step through More in Investigation and response
These videos have no narration — the sound is background music and interface clicks. Step through presents the same content as text.