I am the Systems Administrator for a (total online) Microsoft 365, and Microsoft Azure, Sentinel Cyber school. I have been searching for over a year about ways to combat logins from all over the globe. I receive a daily report of logins that shows me who and where from they are trying to get access to our domain. I came across this article and I am trying to incorporate it into our Microsoft 365, and Azure, Sentinel; it seems it is almost straight forward until about halfway through then I don't seem to get where to create a playbook from. If someone has figured out a way to install Fail2ban in a Microsoft Azure, Sentinel, and 365 Defender location I would greatly appreciate the help, or if someone could help me get through the playbook section that would also be very helpful.
Thank you Morris