Qualys Authenticated Scan on AAD-Joined Device
Detects successful logon events (4624) or special logon attempts (4648) associated with accounts or workstations identified as Qualys scanner agents. This is typically used to identify or baseline vulnerability scanning activity across the environment.
Microsoft Sentinel (KQL)
