IdentityLogonEvents | where LogonType == 'LDAP cleartext' | where ActionType == 'LogonSuccess' | distinct DeviceName, AccountUpn | summarize TotalUniqueClearTextLDAPAuthentications = count() by DeviceName | top 100 by TotalUniqueClearTextLDAPAuthentications | render columnchart with (title="Top 100 Devices with the most Clear Text LDAP sign ins")

Devices that initiate the most clear text LDAP authentications

Query Information

Description

This query visualises the top 100 Devices that initiate the most clear text LDAP authentications. You preferably want to use an encrypted form of LDAP instead of cleartext.

Defender XDR

Sentinel

IdentityLogonEvents
| where LogonType == 'LDAP cleartext'
| where ActionType == 'LogonSuccess'
| distinct DeviceName, AccountUpn
| summarize TotalUniqueClearTextLDAPAuthentications = count() by DeviceName
| top 100 by TotalUniqueClearTextLDAPAuthentications
| render columnchart with (title="Top 100 Devices with the most Clear Text LDAP sign ins")

Explanation

This query is designed to identify and visualize the top 100 devices that are initiating the most LDAP authentications using clear text, which is not secure. The query filters for successful logins that use clear text LDAP, then counts how many unique authentications each device has initiated. The results are sorted to show the devices with the highest number of these authentications, and the top 100 are displayed in a column chart. The goal is to highlight devices that may need to switch to a more secure, encrypted form of LDAP authentication.

KQL Search