[Rule Tuning] Adjusting Investigation Guide for `First Occurrence of Entra ID Auth via DeviceCode Protocol` #4490

terrancedejesus merged 6 commits intomainelastic/detection-rules:mainfrom

rule-tuning-adjusting-investigation-note-azure-device-codeelastic/detection-rules:rule-tuning-adjusting-investigation-note-azure-device-codeCopy head branch name to clipboard