[With KQL commentary] How to create custom alerts to detect logon failures in Microsoft Sentinel

Such signs are often in the early stages of brute force attacks,
Early detection greatly improves the quality of security responses.

In this article, we'll show you how to create custom alerts that detect such "frequent logon failures" in Sentinel!

---

**1. When can I use it? **

This is useful for:

• Failing multiple times with the same user (possible spoofing)
• There are many logon failures from the same IP to many users (possibility of automatic scanning)
• An unnatural number of logon failures in the middle of the night (a sign of an external attack)

2. Example query: 5 or more failures from the same IP

kql

SigninLogs
| where ResultType != 0 // Logon failed
| summarize Count = count() by IPAddress, bin(TimeGenerated, 5m)
| where Count >= 5

This query extracts "IPs that failed to log on more than 5 times in 5 minutes".

💡 Points:

• 'ResultType != 0' is a condition that indicates a logon failure
• Aggregate with 'summarize'
• 'bin()' to round the time to reduce processing load

3. Instructions for Creating Alert Rules

1. Open Sentinel → Analytics
2. Click + Create
3. Select Type: Scheduled Query Rule
4. Set the following

4. Integration with Auto Response (Logic Apps)

After the alert is issued, it can be linked with the following automatic processing.

• Notifications to Microsoft Teams and Slack
• Temporarily block the target IP with Firewall
• Automated email to security team
• Automatic ticketing with ServiceNow and Backlog

5. Post-Implementation Checkpoints

• **Is it really an attack? **
  To prevent false positives, check whether they can be distinguished from normal failures
• **Are there too many notifications? **
  Review alert conditions to minimize noise
• **Does it overlap with other rules? **
  Check if a similar rule already exists

6. Summary: Early detection is key to

brute force countermeasures

Signs of an attack that are difficult to cover with templates can be flexibly addressed with custom alerts.
If you need to design an alert or respond automatically, please feel free to contact Colorkrew Security!