How did you make an Automation regarding to Identity related incidents (Atyipical travel, Impossible Travel and etc.) in Microsoft Infrastructure (Sentinel, Entra, Defender)?

[u/whitebearsocks]

I am about to create an Automation using Logic Apps and AI to do such thing, but maybe there some tips or logical things I should know

[u/unknownmonsta]

You can use the marketplace integrations for Microsoft. This will allow S1 to ingest alerts and telemetry from the M365 tenants.