
Explanation:

In Microsoft 365 Defender advanced hunting , interactive sign-in activity on endpoints is recorded in the DeviceLogonEvents table. This table includes fields such as DeviceName , ActionType , and LogonType .
For failed authentications, the normalized ActionType value is " LogonFailed " . To count failures per device (and optionally by logon type), you filter the target devices and failed-action events, then summarize.
The query pattern is:
* Start from DeviceLogonEvents (the canonical table for endpoint logon successes/failures).
* Apply a where clause to limit to the three devices using DeviceName in (...) .
* Add an and condition for ActionType == " LogonFailed " to select only failed authentications.
* Use summarize with count() to total failures, grouping by DeviceName and LogonType to see counts per device and logon type.
Assembled query:
DeviceLogonEvents
| where DeviceName in ( " CFOLaptop " , " CEOLaptop " , " COOLaptop " ) and ActionType == " LogonFailed "
| summarize LogonFailures=count() by DeviceName, LogonType
This precisely returns the count of failed sign-in authentications on the specified three devices.