☕️

Issue #258 has got me thinking about how best to document the various different YML config stanzas, required/optional fields and expected values, as, particularly for detections, defining a rule definition...

There are a number of Azure MFA failure based detections utilizing `properties.status.errorCode=500121` as a means of detecting one or more MFA auth failures. There's nothing wrong with this in of...