Microsoft Graph Activity Logs - Suspicious TI-IP Address Detection

I'm trying to correlate TI - IP with activities in Graph. Could that be a good detection ? or what is it a better way to protect activites in Microsoft Graph ?