Hi there, I don't believe this script is valid anymore, we should we Azure Monitor \ KQL instead: https://github.com/vanvfields/Microsoft-365/blob/master/Incident%20Response/Install-AzureADProtectionAlerts.ps1