Not Logged In
Query
//With UEBA enabled, look for users that have not logged in
BehaviorAnalytics
| where UsersInsights.IsDormantAccount == trueExplanation
This query is looking for users who have not logged in when User and Entity Behavior Analytics (UEBA) is enabled.