Azure Sentinel Playbook Use Cases

Good morning all!

Currently working on building some security playbooks within Azure Sentinel. We currently do not have any compute resources at the moment, mostly focused on monitoring sign-in logs, custom data connectors, and Defender for 0365 logs/alerts.

Are there any use cases others have built playbooks around that focus on these three fields? Also, has anyone had luck feeding Trellix logs/alerts into Sentinel?