Logon Failure Reasons

Query · kql

DeviceLogonEvents
| where isnotempty(FailureReason)
| summarize count() by FailureReason
| render piechart with (title="Logon Failure Reasons")
Raw source Logon Failure Reasons · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Logon Failure Reasons

## Defender XDR

```
DeviceLogonEvents
| where isnotempty(FailureReason)
| summarize count() by FailureReason
| render piechart with (title="Logon Failure Reasons")
```
## Sentinel
```
DeviceLogonEvents
| where isnotempty(FailureReason)
| summarize count() by FailureReason
| render piechart with (title="Logon Failure Reasons")
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.