// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// Sources that tried many customer accounts and mostly failed.
// Expects one row per attempt: TimeGenerated, SrcIp, AccountId, Outcome.
let Lookback = 24h;
let MinAccounts = 20;  // tune against a normal day
REPLACE_WITH_CUSTOMER_LOGIN_TABLE
| where TimeGenerated between (ago(Lookback) .. now())
| summarize Attempts = count(), Accounts = dcount(AccountId),
    Failures = countif(Outcome == "failure"), Successes = countif(Outcome == "success"),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SrcIp
| where Accounts >= MinAccounts and Failures > Successes * 10
| order by Accounts desc
| take 500