Visualize Devices That Initiate The Most Cleartext LDAP Authentications
Description
This KQL query visualises the top 100 Devices that initiate the most clear text LDAP authentications. You preferably want to use an encrypted form of LDAP instead of cleartext.
Query
Microsoft Defender For Endpoint
Kusto
IdentityLogonEvents
| where LogonType == 'LDAP cleartext'
| where ActionType == 'LogonSuccess'
| distinct DeviceName, AccountUpn
| summarize TotalUniqueClearTextLDAPAuthentications = count() by DeviceName
| top 100 by TotalUniqueClearTextLDAPAuthentications
| render columnchart with (title="Top 100 Devices with the most Clear Text LDAP sign ins")Microsoft Sentinel
Kusto
IdentityLogonEvents
| where LogonType == 'LDAP cleartext'
| where ActionType == 'LogonSuccess'
| distinct DeviceName, AccountUpn
| summarize TotalUniqueClearTextLDAPAuthentications = count() by DeviceName
| top 100 by TotalUniqueClearTextLDAPAuthentications
| render columnchart with (title="Top 100 Devices with the most Clear Text LDAP sign ins")