This is a threat model used to build SOC incident detection/security monitoring use cases for Office 365. Scope is limited to no Exchange Online.
