Further reading
You can refer to the following links for more details:
- Creating custom analytic rules to detect suspicious threats: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom
- Azure Sentinel correlation rules: Active List out; make_list() in, the AAD/AWS correlation example: https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-correlation-rules-active-lists-out-make-list-in/ba-p/1029225