Query

AADSignInEventsBeta
| summarize count() by UserAgent
| sort by count_

About this query

Sign Ins by UserAgent

Query Information

Description

This query can be used to detect rare UserAgents that are used to sign into your tenant. Those rare UserAgents can be used for malicious acces into your tenant.

The query can be extended by filtering on succesful and failed sign ins.

Defender XDR

Sentinel

SigninLogs
| summarize count() by UserAgent
| sort by count_

Explanation

This query is designed to identify unusual UserAgents used for signing into your system, which could indicate potential security threats. Here's a simple breakdown of what the query does:

Data Source: The query looks at sign-in events from two different data sources: AADSignInEventsBeta for Defender XDR and SigninLogs for Sentinel.
Summarization: It counts how many times each UserAgent is used to sign in. A UserAgent is a string that identifies the browser, app, or device making the sign-in request.
Sorting: The results are sorted by the count, showing you which UserAgents are used most frequently.
Purpose: By identifying UserAgents that are rarely used, you can spot unusual or suspicious sign-in attempts that might indicate unauthorized access.

This query can be further refined to focus on either successful or failed sign-ins, providing more specific insights into potential security issues.

KQL Search