Hi Raoul,
There is detailed blog and technical info over here in this blog and some PS scripts , please can you review and go through this it might help in this scenario, if not I will suggest you to raise a support case with Microsoft - https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/using-azure-lighthouse-and-azure-sentinel-to-investigate-attacks/ba-p/1043899
Hope this helps.
JS
==
Please Accept the answer if the information helped you. This will help us and others in the community as well.