SalesforceLoginHistory 表的查询

有关在 Azure 门户中使用这些查询的信息，请参阅 Log Analytics 教程。 有关 REST API，请参阅 查询。

登录尝试失败

返回用户失败登录尝试的计数。

SalesforceLoginHistory
| where TimeGenerated > ago(30d)
| where Status != "Success" and isnotempty(Status)
| summarize
    FailedLoginCount = count(),
    LastFailedAttempt = max(TimeGenerated),
    DistinctSources = dcount(SourceIp),
    FailureReasons = make_set(Status)
    by UserId, Platform, CountryIso
| sort by FailedLoginCount desc