As a SOC analyst, you suspect an on-premises Active Directory account is being targeted by a password-spray attack that Microsoft Defender for Identity is monitoring. You want to run an Advanced Hunting query in Microsoft Defender XDR that correlates failed authentication attempts against domain-joined resources with the source device or IP, using data collected by the Defender for Identity sensors. Which table should you query?