NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Forensics
SaaS and Collaboration Platform Investigations
Master SaaS and collaboration platform investigations. Learn to analyze M365, Google Workspace, and Slack logs for data exfiltration and insider threats.
Room tasks
1What Is SaaS Forensics and Why Does It Matter
2Audit Logs in Microsoft 365 and Google Workspace
3Guided Lab: Reconstructing User Activity from Audit Logs
Frequently Asked Questions
What is SaaS forensics?
SaaS forensics investigates incidents in cloud applications like Microsoft 365, Google Workspace and Slack. Because you do not control the servers, you rely on provider audit logs and APIs for evidence.
Which logs help investigate a Microsoft 365 compromise?
The unified audit log, sign-in logs and mailbox audit records show logins, rule changes and file access. They help detect business email compromise and unauthorised data sharing.
Can I practise SaaS investigations for free?
Yes. This intermediate room on Codelivly is free and uses guided exercises to teach analysis of M365, Google Workspace and Slack activity, without needing your own tenant.