Skip to content

Latest commit

 

History

History
24 lines (19 loc) · 599 Bytes

Visualization - UnauthorizedLogonsByAccount.md

File metadata and controls

24 lines (19 loc) · 599 Bytes

Unauthorized Logon actions by Domain and Account

Defender For Endpoint

DeviceLogonEvents
| where isnotempty(FailureReason)
| where FailureReason == "UnauthorizedLogonType"
| summarize count() by AccountDomain, AccountName
| sort by count_
| render columnchart with(title="Unauthorized Logon by Domain and Account")

Sentinel

DeviceLogonEvents
| where isnotempty(FailureReason)
| where FailureReason == "UnauthorizedLogonType"
| summarize count() by AccountDomain, AccountName
| sort by count_
| render columnchart with(title="Unauthorized Logon by Domain and Account")