Risky service principal log triggering

Question

I have enabled diagnostic settings for RiskyServicePrincipals and ServicePrincipalRiskEvents in Microsoft Entra ID and set up logs to flow both storage account and event hub. I want to have an example log for these types of logs, tried multiple ways ex:

1. Flood of successful and failure requests using service principal.
2. Sending requests from different IP's(very distant) in a short time period.
3. Marking service principal as compromised and confirming/dismissing multiple times in https://entra.microsoft.com/

Which none of these generated either one of these logs. What could be other options to achieve this, any manual way or action to trigger it