FP: If you're able to affirm that no unusual functions had been carried out by LOB app or application is intended to carry out unusually superior volume of graph calls. TP: If you're able to validate that inbox rule was created by an OAuth third-party application with suspicious scopes https://dickr000tjz0.wikilima.com/user