Query

let lookback = 24h;
SigninLogs
| where TimeGenerated >= ago(lookback)
| where ResultType != 0
| summarize
    FailedAttempts = count(),
    LastAttempt = max(TimeGenerated),
    Applications = make_set(AppDisplayName, 10)
    by UserPrincipalName, ResultDescription
| order by FailedAttempts desc

Notes

• ResultType != 0 keeps unsuccessful sign-ins. Confirm the result semantics for the log source you are using.
• make_set() keeps the application context compact when a user has tried several applications.
• Add IPAddress, Location, or ConditionalAccessStatus to the grouping when the investigation needs that detail.

KQL

• Kusto Query Language overview — The main Microsoft Learn reference for KQL syntax, operators, functions, and language concepts.
• KQL quick reference — A compact syntax reference for common query patterns.
• Kusto Query Language reference — Detailed language reference material for operators, statements, and expressions.
• Kusto Explorer — A browser-based interface for exploring data with KQL when your environment and permissions allow access.

Query patterns

• Common KQL functions — Reference for scalar functions used to transform, parse, and inspect values.
• Aggregation functions — Functions for summarizing records with summarize.
• String functions — Useful when filtering, extracting, or normalizing text fields.
• Time series analysis — Patterns for analyzing trends, baselines, and anomalies over time.

Azure Monitor and security

• Azure Monitor Logs overview — How Log Analytics workspaces and KQL fit together in Azure Monitor.
• Microsoft Sentinel hunting — Guidance for using KQL to investigate threats and develop hunting queries.
• Microsoft Entra sign-in logs — Field and behavior reference for sign-in data used in identity investigations.
• Azure Resource Graph query samples — Query examples for inventorying and analyzing Azure resources.

Open Search

• OpenSearch documentation — The main reference for OpenSearch, Dashboards, APIs, and related components.
• OpenSearch Query DSL — Query syntax and examples for searching and filtering indexed data.
• OpenSearch security plugin — Documentation for authentication, authorization, encryption, and audit logging.

Defender

• Microsoft Defender XDR documentation — Product documentation for Microsoft Defender XDR and its connected security experiences.
• Advanced hunting overview — Introduction to investigating security data with Advanced Hunting and KQL.
• Advanced hunting query language — KQL guidance specific to Microsoft Defender data and hunting workflows.

Powershell

• PowerShell documentation — Official reference, tutorials, and administration guidance for PowerShell.
• PowerShell scripting — Core concepts for writing, testing, and maintaining PowerShell scripts.
• PowerShell Gallery — Discover and review community modules and scripts.

CCNA

• Cisco CCNA certification — Current certification overview, exam information, and learning paths.
• CCNA exam topics — The Cisco exam-topics outline for planning study coverage.
• Cisco Packet Tracer — Network simulation tool for practicing topology, configuration, and troubleshooting concepts.

AWS security

• AWS security documentation — Central index for AWS security, identity, compliance, and governance documentation.
• AWS Identity and Access Management — Guidance for identities, permissions, policies, and access controls.
• AWS Well-Architected Security Pillar — Design principles and best practices for securing AWS workloads.
• AWS Security Hub — Centralized view of security findings and security posture checks across AWS accounts.

Community and examples

• Microsoft Security community KQL queries — Community-maintained Microsoft Sentinel hunting query examples.
• Kusto Detective Agency — Interactive challenges for practicing KQL against investigative scenarios.

Keeping this list useful

Prefer links to durable documentation, and add a sentence explaining why a resource is useful. When a link becomes specific to a tool, workspace, tenant, or internal process, move it to a separate private reference instead of publishing it here.