SecurityAlert AlertInfo AlertEvidence SecurityIncident BehaviorAnalytics Anomalies SentinelHealthAlerts Behaviors QueriesDavid Alonso•Oct 27, 2026
SigninLogs AADNonInteractiveUserSignInLogs AADServicePrincipalSignInLogs AADManagedIdentitySignInLogs CloudAppEvents AuditLogs AADUserRiskEvents IdentityInfo IdentityLogonEvents IdentityQueryEvents IdentityDirectoryEvents MicrosoftGraphActivityLogsApps Identity QueriesDavid Alonso•Oct 27, 2026
AlertInfo AlertEvidence DeviceProcessEvents DeviceEvents DeviceLogonEvents DeviceNetworkEvents DeviceRegistryEventsMDE Endpoint QueriesDavid Alonso•Oct 27, 2026
EmailEvents AlertInfo AlertEvidence CloudAppEvents EmailUrlInfo EmailAttachmentInfo SigninLogs AADNonInteractiveUserSignInLogsMDO BEC Ai TM QueriesDavid Alonso•Oct 27, 2026
DeviceRegistryEventsSuspicious Windows Policy And Security Registry TamperingBenjamin Zulliger•Oct 22, 2026
_GetWatchlistSigninLogs+1Multiple Suspicious Authentication Session From Unfamiliar LocationJose Sebastián Canós•Oct 22, 2026
DeviceProcessEventsDeviceLogonEvents+2Win RM Child Process With Inbound Network LogonBenjamin Zulliger•Oct 22, 2026
DeviceNetworkEventsDeviceImageLoadEventsMultiple Uncommon Loaded Image Connection To Suspicious DomainJose Sebastián Canós•Oct 22, 2026
DeviceNetworkEventsDevice Network Events Uncommon Process Connection To Suspicious DomainJose Sebastián Canós•Oct 22, 2026
BehaviorAnalyticsUEBA High Priority Activity From MCP Client User AgentsBenjamin Zulliger•Oct 15, 2026
DeviceProcessEventsInfostealer Browser Kill And Verify Sweep From Single ProcessBenjamin Zulliger•Oct 15, 2026
CloudKeyVaultEventsKey Vault Secret Access From New IP Address Per IdentityBenjamin Zulliger•Oct 13, 2026
CloudKeyVaultEventsAzure Key Vault Mass Secret Retrieval By Single ActorBenjamin Zulliger•Oct 13, 2026
DeviceProcessEventsDeviceFileCertificateInfoRenamed System And Third Party Binaries With Signature ContextBenjamin Zulliger•Oct 13, 2026
DeviceProcessEventsDeviceFileEventsBrowser Cache Smuggling Payload Extraction And ExecutionBenjamin Zulliger•Oct 13, 2026
EntraIdSignInEventsCloudKeyVaultEventsRisky Sign In Followedby Key Vault ActivityBert-Jan Pals•Oct 13, 2026
AuditLogsEntra App Instance Property Lock Tampering Service Principal Lock ConfigurationJay Kerai•Oct 2, 2026
AADServicePrincipalSignInLogsAADServicePrincipalRiskEvents03 Service Principal Context And RiskDavid Alonso•Oct 2, 2026
EntraAgentIdentityBlueprints EntraAgentIdentities EntraAgentUsers UnifiedAgentObservability07 Sentinel Datalake Agent Tables PreflightDavid Alonso•Oct 2, 2026
EntraAgentIdentityBlueprintsEntraAgentIdentities+108 Datalake Agent Identity Inventory JobDavid Alonso•Oct 2, 2026
