# SaaS and Collaboration Platform Investigations

> Master SaaS and collaboration platform investigations. Learn to analyze M365, Google Workspace, and Slack logs for data exfiltration and insider threats.

Canonical: https://codelivly.com/rooms/saas-and-collaboration-platform-investigations
Last updated: 2026-09-17

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 3 |
| Estimated time | 30 min |
| XP | 100 |

This module dives into the complexities of investigating Software-as-a-Service (SaaS) and collaboration platforms like Microsoft 365, Google Workspace, and Slack. You will learn how to navigate unified audit logs, detect unauthorized data sharing, investigate compromised accounts, and trace lateral movement within cloud workspaces. By mastering SaaS investigations, you will be equipped to uncover insider threats, Business Email Compromise (BEC), and cloud-based data exfiltration in modern enterprise environments.

## Lessons

1. What Is SaaS Forensics and Why Does It Matter (30 min)
2. Audit Logs in Microsoft 365 and Google Workspace (30 min)
3. Guided Lab: Reconstructing User Activity from Audit Logs (30 min)

## Related

- [Learning path: Cloud and Email Forensics](https://codelivly.com/learning-paths/cloud-and-email-forensics)
- [All rooms](https://codelivly.com/rooms)