Reusable KQL recipes you can copy and adapt
Find accounts with repeated failed sign-ins, a common brute-force signal.
Summarise process launches to baseline what runs where.