8 docs getaggt mit "ms sentinel"

These queries are related to authentication.

New Azure AD audit events detected

TI map IP entity to DnsEvents

You can also search for the messageId:

Connection to some IP

Remote Code Execution

"Monitor Site Collection Administrator" incidents

Multi-workspace