Authentication Frequency Analysis by IP and App
This rule aggregates sign-in log activity for a specific user to identify the volume and distribution of authentication attempts across different IP addresses, applications, and client types within a specified time range. It is primarily used for identifying anomalies in access patterns that might indicate credential abuse or unauthorized access.
Microsoft Sentinel (KQL)
