KQL snippet library

SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != "0"
| summarize failures=count() by UserPrincipalName, ResultType, ResultDescription, AppDisplayName, IPAddress
| order by failures desc

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType == "0"
| extend mfa = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod)
| where AuthenticationRequirement != "multiFactorAuthentication"
| summarize count() by UserPrincipalName, AppDisplayName, ClientAppUsed

SigninLogs
| where TimeGenerated > ago(24h)
| mv-expand CAP = ConditionalAccessPolicies
| where CAP.result in ("failure", "reportOnlyFailure")
| summarize hits=count() by tostring(CAP.displayName), tostring(CAP.result), UserPrincipalName
| order by hits desc

IntuneDevices
| where TimeGenerated > ago(1d)
| summarize arg_max(TimeGenerated, *) by DeviceId
| summarize count() by OS, Ownership, JoinType

IntuneOperationalLogs
| where TimeGenerated > ago(7d)
| where Result != "Success"
| summarize count() by AppName, Result, ErrorCode, DeviceName
| order by count_ desc

AlertInfo
| where Timestamp > ago(24h)
| summarize count() by Title, Severity, Category
| order by count_ desc

DeviceLogonEvents
| where Timestamp > ago(24h)
| where ActionType == "LogonFailed"
| summarize failures=count() by DeviceName, AccountName, LogonType
| order by failures desc

AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName has_any ("Add member to role", "Add eligible member to role")
| project TimeGenerated, OperationName, InitiatedBy, TargetResources, Result
| order by TimeGenerated desc