Sentinel KQL

SecurityEvent | where EventID == 4625 | summarize count() by IpAddress

Sentinel KQL query that groups failed logons by source IP over the workspace's Security Events, to detect brute force and password spraying.

Run it in Microsoft Sentinel when the hosts' Security logs are in Log Analytics and you want the ranking of failure sources: the query filters for 4625 and summarizes by IpAddress — an IP with thousands of failures is brute force, a distribution across accounts is spraying. It's the base search for authentication hunting in Azure, reproducible and convertible into a scheduled alert with one click. In hybrid environments it's the natural path: the events are already in the workspace and the same query works for both hunting and the rule.

Don't use it if the Security logs don't reach Log Analytics: without the Windows Security Events connector, the SecurityEvent table is empty. The IpAddress field of 4625 depends on the connector's parsing — in older configurations it may come as null and the summarize groups everything under the empty value. And watch out for cost: queries on SecurityEvent without a broad time window are expensive in a large workspace; narrow with TimeGenerated and use summaries (summarize) before bringing events. For the alert, convert the query into a scheduled rule with threshold and entity (IP).