https://blog.sonnes.cloud/microsoft-defender-xdr-activity-log-and-change-incident-severity/