Topics:
- Country logins
- Anomalous Token creation, etc
- Various Logins (risky, failed, non-existant, etc)
- Password resets
- MFA
- Device specific events
- spoolsv.exe
To-Be-Added:
- phishing file extension
- Azure job creation
- New user in admin group -> PIM
- Malicious HTTP Traffic -> HTTP Traffic
- Anomalous AAD Account Creation