Initial commit: KQL ↔ SDL PowerQuery proof of equivalence

2026-06-10 05:57:15 +00:00 · 2026-06-01 09:57:14 +02:00
commit 23cbaa9c08
91 changed files with 5966 additions and 0 deletions
@@ -0,0 +1,7 @@
+let codes = dynamic([50053,50126,50055,50057,50155,50105,50133,50005,50076,
+                                50079,50173,50158,50072,50074,53003,53000,53001,50129]);
+SigninLogs
+| where TimeGenerated > ago(1d) | where ResultType in (codes)
+| summarize FailedAttempts = count(), UniqueUsers = dcount(UserPrincipalName)
+    by IPAddress
+| where FailedAttempts > 5 and UniqueUsers > 5