from logs-azure.signinlogs* metadata _id, _version, _index
| where
    // filter for Entra Sign-In Logs
    event.dataset == "azure.signinlogs"
    and azure.signinlogs.operation_name == "Sign-in activity"

    // filter for MFA attempts with OATH conditional access attempts or TOTP
    and azure.signinlogs.properties.authentication_requirement == "multiFactorAuthentication"
    and azure.signinlogs.properties.mfa_detail.auth_method == "OATH verification code"

    // filter on failures only from brute-force attempts
    and azure.signinlogs.properties.conditional_access_status == "failure"
    and azure.signinlogs.result_description == "Authentication failed during strong authentication request."
| keep azure.signinlogs.properties.sign_in_identifier
| stats
    // aggregate by the sign-in account or principal
    failed_totp_code_attempts = count(*) by azure.signinlogs.properties.sign_in_identifier
| where
    // filter on high frequency for a single user
    failed_totp_code_attempts > 30