medium10 pts · first answer countsmicrosoft-sentinelkqlcloud-identity

KQL for failed Entra sign-ins

In Microsoft Sentinel, which KQL query returns failed Microsoft Entra ID sign-ins in the last day, counted per user?

A.SigninLogs | where TimeGenerated > ago(1d) | where ResultType == "0" | countB.SecurityEvent | where EventID == 4624 | summarize count() by AccountC.SigninLogs | where TimeGenerated > ago(1d) | where ResultType != "0" | summarize Failures = count() by UserPrincipalNameD.SigninLogs | take 100 | where ResultType == "failure"

Discussion 0

Join free to post in the discussion.

Related questions

More Cloud Identity questions