You have several Azure SQL Servers and Azure Sentinel workspace. You need to create a saved query in the workspace to find events reported by Advanced Threat Protection for Azure SQL Database. What should you do?