---
title: M365 Purview Security Compliance Signal
description: Collects alerts generated by Microsoft Purview (formerly Office 365 Security & Compliance Center) through the SecurityComplianceCenter provider. These...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules_building_block/initial_access_microsoft_purview_security_compliance_signal
products:
  - Elastic Security
---

# M365 Purview Security Compliance Signal
Collects alerts generated by Microsoft Purview (formerly Office 365 Security & Compliance Center) through the
SecurityComplianceCenter provider. These alerts represent policy violations, compliance issues, and threats detected by
Microsoft Purview's built-in detection capabilities including DLP policy matches, eDiscovery actions, retention policy
violations, and other compliance-related events. This building block rule generates security events for correlation,
threat hunting, and telemetry collection without creating standalone alerts, reducing alert fatigue while maintaining
comprehensive visibility into Microsoft Purview's compliance and security detections.
**Rule type**: query
**Rule indices**:
- logs-o365.audit-*
- filebeat-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://learn.microsoft.com/en-us/purview/audit-log-activities](https://learn.microsoft.com/en-us/purview/audit-log-activities)](https://learn.microsoft.com/en-us/purview/audit-log-activities)
- [[https://learn.microsoft.com/en-us/purview/audit-solutions-overview](https://learn.microsoft.com/en-us/purview/audit-solutions-overview)](https://learn.microsoft.com/en-us/purview/audit-solutions-overview)

**Tags**:
- Domain: Cloud
- Domain: SaaS
- Data Source: Microsoft 365
- Data Source: Microsoft 365 Audit Logs
- Data Source: Microsoft Purview
- Use Case: Threat Detection
- Use Case: Compliance Monitoring
- Tactic: Initial Access
- Tactic: Credential Access
- Tactic: Collection
- Tactic: Exfiltration
- Tactic: Impact
- Rule Type: BBR
- Rule Type: Custom Query (KQL)
- Platform: Microsoft 365
- Service: Microsoft Purview

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

### Additional notes

For information on troubleshooting the maximum alerts warning please refer to this [guide](https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts).

## Rule Query

```kuery
event.dataset:o365.audit and event.provider:SecurityComplianceCenter and event.code:SecurityComplianceAlerts
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Initial Access
  - Id: TA0001
  - Reference URL: [[https://attack.mitre.org/tactics/TA0001/](https://attack.mitre.org/tactics/TA0001/)](https://attack.mitre.org/tactics/TA0001/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Credential Access
  - Id: TA0006
  - Reference URL: [[https://attack.mitre.org/tactics/TA0006/](https://attack.mitre.org/tactics/TA0006/)](https://attack.mitre.org/tactics/TA0006/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Collection
  - Id: TA0009
  - Reference URL: [[https://attack.mitre.org/tactics/TA0009/](https://attack.mitre.org/tactics/TA0009/)](https://attack.mitre.org/tactics/TA0009/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Exfiltration
  - Id: TA0010
  - Reference URL: [[https://attack.mitre.org/tactics/TA0010/](https://attack.mitre.org/tactics/TA0010/)](https://attack.mitre.org/tactics/TA0010/)

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Impact
  - Id: TA0040
  - Reference URL: [[https://attack.mitre.org/tactics/TA0040/](https://attack.mitre.org/tactics/TA0040/)](https://attack.mitre.org/tactics/TA0040/)