List Sign-ins By UserAgent
Description
This KQL query can be used to detect rare UserAgents that are used to sign into your tenant. Those rare UserAgents can be used for malicious access into your tenant.
The query can be extended by filtering on successful and failed sign ins.
Query
Microsoft Defender For Endpoint
Kusto
AADSignInEventsBeta
| summarize count() by UserAgent
| sort by count_Microsoft Sentinel
Kusto
SigninLogs
| summarize count() by UserAgent
| extend x = parse_user_agent(UserAgent, dynamic(["browser","os","device"]))
| sort by count_