Recent DiscussionsMost RecentNewest TopicsMost LikesSolutionsTagged:TagRe: More than 10 failed logins per user and deviceThe following should help you. DeviceLogonEvents | where AccountName in~ ("Tythadius", "Tythadius2") | where ActionType == "LogonFailed" | summarize LogonFailures = count() by AccountName, LogonType | where LogonFailures > 10
