Logon Events inside Organization Domain
This rule identifies all logon events within the organization's domain by querying the IdentityLogonEvents table. It extracts distinct account display names, UPNs, device names, destination device names, action types, account domains, and applications involved in the logon.
Microsoft Sentinel (KQL)
