Log Analytics is only as useful as the queries you can write against it. These are the Kusto Query Language queries we open first during an investigation. Each assumes the relevant table is being collected into your workspace — check the tables reference if a query returns nothing.
Adjust the timespan and resource filters to your environment. None of these mutate anything; they are read-only.
Sign-in failures by user (last 24h)
Where are authentication failures concentrating? Spikes here often precede an incident.
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType != 0
| summarize failures = count() by UserPrincipalName, ResultDescription
| top 25 by failures desc
Conditional access blocks
Legitimate users blocked by policy — the other side of the sign-in story.
SigninLogs
| where TimeGenerated > ago(24h)
| where ConditionalAccessStatus == "failure"
| summarize count() by UserPrincipalName, AppDisplayName
| order by count_ desc
Failed resource deployments
When a pipeline reports success but the environment looks wrong, start here.
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue endswith "write"
| where ActivityStatusValue == "Failure"
| summarize count() by Resource, ResourceGroup, ActivityStatusValue
| order by count_ desc
Top resources by log volume
Log volume is cost. Find the noisy resource before the bill does.
Usage
| where TimeGenerated > ago(7d)
| summarize GB = sum(Quantity) / 1000 by DataType
| top 15 by GB desc
Where the rest live
The full pack — ten queries covering resource health, NSG flow anomalies, Key Vault access, and App Gateway backend errors — ships as the working set we hand to clients during a monitoring and reliability engagement. The four above are the ones we run in the first ten minutes.
A note on trust: KQL operators and table schemas evolve. This pack carries a review date for exactly that reason — verify a query against the current tables reference if your results look off.