{"slug":"analyzing-office365-audit-logs-for-compromise","source_name":"analyzing-office365-audit-logs-for-compromise","name":"Analyzing Office365 Audit Logs For Compromise","description":"Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.","version":1,"lift":{"pass_rate_delta_pts":18.18,"pass_rate_pct":22.7,"total_cases":22,"passed_cases":5,"tokens_delta_pct":-7.3,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-27T23:55:06.400601+00:00"},"skill_score":0.2273,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":18.18,"with_pass_pct":22.7,"without_pass_pct":4.5,"tokens_delta_pct":-7.3,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":21,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-27T23:55:06.400601+00:00","run_id":"ba651835-d660-468d-8cf9-af47ec889da9","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"e2a18d99bfbf22b8e4344cb50ca11cec98c2446be49eedaa5f252097afe955b0","raw_url":"https://app.decimal.ai/s/analyzing-office365-audit-logs-for-compromise/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/analyzing-office365-audit-logs-for-compromise"}