Further reading

You can refer to the following links for more details:

• Creating custom analytic rules to detect suspicious threats:

  https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

• Microsoft Sentinel correlation rules: Active List out; make_list() in, the AAD/AWS correlation example:

  https://techcommunity.microsoft.com/t5/azure-sentinel/azure-sentinel-correlation-rules-active-lists-out-make-list-in/ba-p/1029225

• Microsoft's Microsoft Sentinel Query Style Guide:

  https://github.com/Azure/Azure-Sentinel/wiki/Query-Style-Guide#severity

• Microsoft Sentinel entity types reference:

  https://docs.microsoft.com/en-us/azure/sentinel/entities-reference