Question

Your company collects performance and event data from 40 Azure VMs into a single Log Analytics workspace. The security team asks you to produce a report that shows the total number of failed sign-in events (EventID 4625) generated by each computer over the last 24 hours, sorted from highest to lowest. Which Kusto Query Language (KQL) query should you run in Azure Monitor Logs?

Accepted Answer

SecurityEvent | where TimeGenerated > ago(24h) | where EventID == 4625 | summarize FailedLogons = count() by Computer | sort by FailedLogons desc

Answer

SecurityEvent | where TimeGenerated > ago(24h) | where EventID == 4625 | count | sort by Computer desc

Answer

SecurityEvent | where TimeGenerated > ago(24h) | where EventID == 4625 | project Computer, EventID | take 40

Answer

SecurityEvent | where TimeGenerated > ago(1d) | where EventID == 4625 | distinct Computer | sort by Computer asc