High Volume of Azure App Service Operations from Single Caller
Detects an unusually high volume of successful operations related to Azure App Services originating from a single caller within a one-hour window. This could indicate automated activity, reconnaissance, or a misconfigured application.
Microsoft Sentinel (KQL)
