All Detections

User running multiple queries that fail

Azure Sentinel@AzureSentinel
updated Jun 17, 20251041

'This hunting query looks for users who have multiple failed queries in a short space of time.'

Microsoft Sentinel (KQL)