Quick reference for Microsoft Sentinel (KQL) and Splunk (SPL) detection rules.
Tracks multiple failed authentication events across your environments.
SigninLogs | where ResultType == "50126" | summarize Count=count() by UserPrincipalName, IPAddress | where Count > 5
Monitors Windows Security Event ID 4625 for potential target attacks.
index=security sourcetype="WinEventLog:Security" EventCode=4625 | stats count by user, src_ip | where count > 10
