app@sharepoint events are seen in Investigate tabs for O365

Products

• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard

Issue/Introduction

Large number of activity events are observed with user [email protected] for Office 365 securelet.

Cause

app@sharepoint is a service account for sharepoint which is used by CloudSOC to download management api logs, quarantine files etc.

Resolution

Symantec Engineering has plans to remove this in the future release with new the management API . As this may bring concerns to high number of activities contact support to disable management api to stop seeing app@sharepoint events

NOTE:  On disabling the management api from the backend, admin activities will not be reported but you will continue to receive relevant OneDrive/Site/Exchange actives done by users.  

Refrence https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/symantec-cloudsoc/cloud/securlets-home/office-securlet-intro/supported-activities/admin-activities.html