Network Connections and Entra ID Sign-ins from Iran
This rule detects network connection events and Entra ID sign-in events originating from Iran. It aggregates these events hourly to identify potential suspicious activity from a geo-restricted or high-risk country.
Microsoft Sentinel (KQL)
