The first day reading logons
The day is one successful logon, one failure, and a clear line between a password that matched and a token that was shown later. Then you write that down.
One success and one failure
Pick one success and one failure from a log you are allowed to read. Write the account, the time, the source, and whether it succeeded. On Windows, 4624 is a success and the logon type says how. 4625 is a failure. Read them as a pair when they share an account or a source.
A city name in a chat message is not that record. If you cannot point at the four fields, you are not ready to call it a compromise. The page for a sign-in from somewhere new is that pause.
MFA
Write whether a second check happened: a push, a code, or a number the user had to match. A stack of pushes that a tired person accepts is a different event from a password that was wrong.
The MFA lab is a queue of pushes. Decide which ones you would treat as the user, and which ones you would stop. Do not reset a password because a prompt looked annoying.
A password is not a token
A password check means the secret matched at that moment. A token can be presented again without anyone typing the password. Revoking the password does not, by itself, take back a token that is still valid. Say which one the log shows.
The token lab is five tokens you read before you trust a claim. The identity workbench is the longer set of lessons. The finding is the pair of logons, what kind of secret they used, and what you would change, which on day one may be “revoke the session, not every password in the company.”