I’ve only recently become a consumer of O365, and have not done any administration, investigation, or poking around on the undersides of it, but these two links came across on a local Slack channel and I wanted to pull them out and save them for future reference. Both of these github links offer support for investigating O365 phishing emails and shenanigans. First, one from LogRhythm and another by the OfficeDev crew.