ConnectWise Suspicious Cloud Application Sign-In or Activity from Indicator or Compromised Vendor
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Microsoft Sentinel (KQL)
