Failed AWS Console logons but success logon to AzureAD
'Identifies a list of IP addresses with a minimum number (default of 5) of failed logon attempts to AWS Console. Uses that list to identify any successful Microsoft Entra ID logons from these IPs within the same timeframe.'
Microsoft Sentinel (KQL)
