Question
You are investigating an incident by using Microsoft 365 Defender.
You need to create an advanced hunting query to count failed sign-in authentications on three devices named CFOLaptop, CEOLaptop, and COOLaptop.
How should you complete the query? To answer, drag the appropriate values to the four lines of the query in the answer area, in order. The second and third lines are joined by the operator "and".
NOTE: Each correct selection is worth one point.
Explanation
Sign-in (logon) activity on devices is recorded in the DeviceLogonEvents table, not the general DeviceEvents table. The query filters to the three laptops with where DeviceName in (...) and, joined by "and", keeps only failed attempts with ActionType == "LogonFailed". FailureReason is a separate column that describes why a logon failed, so comparing ActionType to FailureReason never matches a failed logon. Finally, summarize LogonFailures=count() by DeviceName, LogonType produces the count per device; project cannot use the count() aggregation.
