KQL - Security Information Changes Following Risk Alerts
Correlates Microsoft Entra identity risk detections with subsequent password changes, MFA registrations, and security information modifications. Helps identify potential account compromise scenarios where authentication methods or credentials are altered after suspicious sign-in activity.
Microsoft Sentinel (KQL)
