Failed AzureAD logons but success logon to AWS Console
'Identifies a list of IP addresses with a minimum number (defualt of 5) of failed logon attempts to Microsoft Entra ID. Uses that list to identify any successful AWS Console logons from these IPs within the same timeframe.'
Microsoft Sentinel (KQL)
