Logon Failure Reasons
Visualization Logon Failure Reasons
Query
DeviceLogonEvents
| where isnotempty(FailureReason)
| summarize count() by FailureReason
| render piechart with (title="Logon Failure Reasons")About this query
Logon Failure Reasons
Defender XDR
Sentinel
DeviceLogonEvents
| where isnotempty(FailureReason)
| summarize count() by FailureReason
| render piechart with (title="Logon Failure Reasons")
Explanation
This query is designed to analyze and visualize the reasons for logon failures in a system. It is applicable to both Defender XDR and Sentinel platforms. Here's a simple breakdown of what the query does:
-
Data Source: The query is run on a table called
DeviceLogonEvents, which contains information about logon events on devices. -
Filter: It filters the data to only include events where there is a specified reason for the logon failure (
isnotempty(FailureReason)). -
Summarization: It counts the number of occurrences of each unique logon failure reason (
summarize count() by FailureReason). -
Visualization: The results are displayed as a pie chart, with the title "Logon Failure Reasons". This visualization helps in quickly understanding the distribution of different failure reasons.
In summary, the query identifies and visualizes the different reasons for logon failures, showing how frequently each reason occurs, using a pie chart for easy interpretation.