Entra device registration shortly after risky or anomalous sign-in
Correlates a high-risk or compromised Microsoft Entra sign-in event with a subsequent device registration (Add device or Register device) performed by the same user account within a 3-hour window.
Microsoft Sentinel (KQL)
