# SharePoint Activity Threat Response

**URL:** <https://community.netwrix.com/t/sharepoint-activity-threat-response/120748>\
**Category:** Threat Manager Ideas\
**Tags:** threat-manager, sharepoint, sharepoint-online, under-review\
**Created:** [January 12, 2026, 11:05pm UTC](https://community.netwrix.com/t/sharepoint-activity-threat-response/120748 "2026-01-12T23:05:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DevonAnderson](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/devonanderson/32/1436_2.png) [@DevonAnderson](https://community.netwrix.com/u/DevonAnderson)\
**Post date:** [January 12, 2026, 11:05pm UTC](https://community.netwrix.com/t/sharepoint-activity-threat-response/120748/1 "2026-01-12T23:05:08Z")

</div>

### What is a one sentence summary of your feature request?

Ability for NTM to ingest SP activity events and trigger threats/playbooks against it

### Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

NTM does not currently have visibility into SP and a lot of folks are moving their data to SPO. I think this would be a big feature (which may already be on the roadmap but didn’t see it in here).

### How do you currently solve the challenges you have by not having this feature?

Sending SP activity events to a SIEM can help right now, but NTM has capabilities that would be nice to be able to utilize.

---

<div class="post-metadata">

**Author:** ![justin-eevabits](https://avatars.discourse-cdn.com/v4/letter/j/a183cd/32.png) [@justin-eevabits](https://community.netwrix.com/u/justin-eevabits)\
**Post date:** [January 17, 2026, 5:06am UTC](https://community.netwrix.com/t/sharepoint-activity-threat-response/120748/2 "2026-01-17T05:06:52Z")

</div>

We were working with a customer asking for this exact thing since they are already receiving file activity from NAM.

---

<div class="post-metadata">

**Author:** ![kevin.joyce](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/kevin.joyce/32/645_2.png) [@kevin.joyce](https://community.netwrix.com/u/kevin.joyce)\
**Post date:** [January 20, 2026, 5:01pm UTC](https://community.netwrix.com/t/sharepoint-activity-threat-response/120748/3 "2026-01-20T17:01:11Z")

</div>

Hey everyone, thanks for the feedback and submission.

There is no short-term plan to add SharePoint activity to Threat Manager at this time. This could be something that ends up in 1Secure in the future as we continue to build out the platform.