Explanation:

In Microsoft 365 Defender advanced hunting, interactive sign-in activity on endpoints is recorded in the DeviceLogonEvents table. This table includes fields such as DeviceName, ActionType, and LogonType.
For failed authentications, the normalized ActionType value is "LogonFailed". To count failures per device (and optionally by logon type), you filter the target devices and failed-action events, then summarize. The query pattern is:
* Start from DeviceLogonEvents (the canonical table for endpoint logon successes/failures).
* Apply a where clause to limit to the three devices using DeviceName in (...).
* Add an and condition for ActionType == "LogonFailed" to select only failed authentications.
* Use summarize with count() to total failures, grouping by DeviceName and LogonType to see counts per device and logon type.
Assembled query:
DeviceLogonEvents
| where DeviceName in ("CFOLaptop", "CEOLaptop", "COOLaptop") and ActionType == "LogonFailed"
| summarize LogonFailures=count() by DeviceName, LogonType
This precisely returns the count of failed sign-in authentications on the specified three devices.