easy5 pts · first answer countssiemkql

Counting rows in KQL

Which KQL query returns the number of failed sign-ins in the last day as a single number?

A.SigninLogs | where TimeGenerated > ago(1d) and ResultType != "0" | take 1B.SigninLogs | where TimeGenerated > ago(1d) and ResultType != "0" | distinctC.SigninLogs | where TimeGenerated > ago(1d) and ResultType != "0" | projectD.SigninLogs | where TimeGenerated > ago(1d) and ResultType != "0" | count

Discussion 0

Join free to post in the discussion.

Related questions

More SIEM and alert triage questions More Kql questions