Burst of multiple reconnaissance commands could indicate initial activity after compromise

All of a sudden we have started receiving alerts for "Burst of multiple reconnaissance commands could indicate initial activity after compromise [seen multiple times]" for all the subscriptions/tenan...