from logs-azure.signinlogs*
| keep
    @timestamp,
    event.dataset,
    event.category,
    azure.signinlogs.properties.is_interactive,
    azure.signinlogs.properties.authentication_requirement,
    azure.signinlogs.properties.resource_display_name,
    azure.signinlogs.properties.status.error_code,
    azure.signinlogs.properties.resource_service_principal_id,
    azure.signinlogs.category,
    event.outcome,
    azure.signinlogs.properties.user_principal_name,
    source.ip
// truncate the timestamp to a 10-minute window
| eval target_time_window = DATE_TRUNC(10 minutes, @timestamp)
| WHERE
  event.dataset == "azure.signinlogs"
  and event.category == "authentication"
  and azure.signinlogs.properties.is_interactive == false
  and azure.signinlogs.properties.authentication_requirement == "singleFactorAuthentication"
  and event.outcome != "success"
  and azure.signinlogs.properties.status.error_code in (50053, 50126, 50055, 50056, 50064, 50144)
    // for tuning review azure.signinlogs.properties.status.error_code
    // https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes

// count the number of unique user login attempts
| stats
    unique_user_login_count = count_distinct(azure.signinlogs.properties.resource_service_principal_id) by
        target_time_window,
        azure.signinlogs.properties.user_principal_name,
        azure.signinlogs.properties.status.error_code

// filter for >= 20 failed SFA auth attempts with the same error codes
| where unique_user_login_count >= 20