// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Sentinel SigninLogs; one source IP and client AppId. Last 24h; at most 100 buckets.
// 50126=invalid credentials, 50053=locked, 50034=unknown account; MFA challenges are not counted as password failures.
// Ten failed accounts in five minutes is a starting threshold, not an AI signature.
let SourceIP = "REPLACE_WITH_SOURCE_IP";
let ClientApp = "REPLACE_WITH_CLIENT_APP_ID";
SigninLogs
| where TimeGenerated between (ago(24h) .. now())
| where IPAddress == SourceIP and AppId == ClientApp
| summarize Failures=countif(ResultType in ("50126","50053","50034")),
    FailedAccounts=dcountif(UserPrincipalName, ResultType in ("50126","50053","50034")),
    Successes=countif(ResultType == "0"),
    AccountSample=make_set_if(UserPrincipalName, ResultType in ("50126","50053","50034"), 10)
    by IPAddress, AppId, Window=bin(TimeGenerated, 5m)
| where FailedAccounts >= 10
| order by Window desc
| take 100