// Sample query to detect If there are more then 3 failed logon authentications on high value assets.
// Update DeviceName to reflect your high value assets.
// For questions @MiladMSFT on Twitter or [email protected]
DeviceLogonEvents
| where DeviceName in ("DeviceName1","DeviceName2"😉
| where ActionType == "LogonFailed"
| summarize LogonFailures=count() by DeviceName, LogonType, InitiatingProcessCommandLine
| where LogonFailures > 3
| project LogonFailures, DeviceName, LogonType, InitiatingProcessCommandLine
| sort by LogonFailures desc
Originally posted by FalconPaunch!
https://x.com/piersmorgan/status/1895044617675972960?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5EtweetWhy did they kill the dog?
They didn’t. It says no suspicious circumstances.
Probably carbon monoxide poisoning or something