BitLocker Key Retrieval
'Looks for users retrieving BitLocker keys. Enriches these logs with a summary of alerts associated with the user accessing the keys. Use this query to start looking for anomalous patterns of key retrieval. Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#bitlocker-key-retrieval'
Microsoft Sentinel (KQL)
