// Reference query for Microsoft Sentinel / Log Analytics SigninLogs.
// Failed sign-ins are investigation leads, not a detection verdict.
let Lookback = 24h;
let MinimumFailures = 5;
SigninLogs
| where TimeGenerated >= ago(Lookback)
| where ResultType != "0"
| summarize
    FailureCount = count(),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    IPAddresses = make_set(IPAddress, 20),
    Applications = make_set(AppDisplayName, 20),
    ResultCodes = make_set(ResultType, 20)
    by UserPrincipalName
| where FailureCount >= MinimumFailures
| order by FailureCount desc