Server-Side Sign-In Aggregation for Spray and Brute-Force Triage

June 11, 2026 · InfraScout Team

Entra ID sign-in logs are where password-spray and brute-force attacks show themselves first — but they are enormous, and Microsoft Graph offers no way to group or summarize them on the server. The only option used to be pulling raw sign-in rows back and counting them yourself. Inside an AI assessment that is a non-starter: a busy tenant produces tens of thousands of sign-ins a day, and feeding those rows into the model burns its entire context budget before it can reach a conclusion. The new mscloud_security_aggregate_sign_ins tool closes that gap. It pages through the sign-in logs on the server and hands back a compact, faceted roll-up — the answer to "is anyone being sprayed?", not the data dump you would otherwise have to reason over. It is part of InfraScout's Microsoft Cloud — Security tool set, and this post explains what it does and when to reach for it.

A roll-up, not a data dump

The difference between this tool and a raw sign-in listing is where the counting happens. Instead of returning rows for the AI to tally, InfraScout walks the matching sign-ins server-side and returns only the shape of the activity. A single call comes back with four facets that, together, describe an attack the way an analyst would:

• Top source IP addresses by volume — who is generating the most sign-in traffic in the window, so the loudest sources surface immediately.
• The distribution of failure reasons and error codes — what is actually failing, which separates a bad-password storm from blocked Conditional Access or expired credentials.
• Distinct users seen per source IP — the spray signal itself: one IP touching many different accounts is the defining shape of a password-spray attempt, where a brute-force run hammers a single account instead.
• Success-after-failure candidates — accounts that failed repeatedly from an IP and then succeeded, ordered by time. This is the tell that matters most: a sequence of failures followed by a success from the same source is what a compromised credential looks like.

Because the work happens before anything reaches the model, the AI receives a handful of summarized facets rather than thousands of rows. It can read the answer, write a finding, and move on — the assessment stays fast and the context budget stays intact.

One-call password-spray triage

Knowing which filters describe a spray — the right window, the right sign-in outcomes, the right grouping — is exactly the kind of expertise that does not belong in every prompt. The tool ships with a built-in spray_hunt preset that sets those filters for you. Ask InfraScout whether anyone is being sprayed and it runs the aggregation with the spray-tuned configuration already in place, then returns the distinct-users-per-IP facet front and center. You get one-call triage instead of a multi-step setup, and the preset stays a starting point — you can still narrow by time range or focus on a single source when an investigation calls for it.

This is the question the tool was built to answer in plain language: "Is anyone being sprayed right now? Which IPs are hammering us, and did any of them eventually get in?" The roll-up answers all three at once.

Bounded so it never hangs an assessment

Aggregating across a wide time range could, in principle, page through a very large log. The tool is deliberately bounded so that never stalls a conversation: it stops at a record cap and within a wall-clock budget, whichever it reaches first. When it stops early, it does not pretend the picture is complete — it flags the result as truncated and names why it stopped, distinguishing "I ran out of time" from "I hit the record cap," and includes machine-readable warnings alongside the human-readable note.

That distinction is what makes the truncation useful rather than alarming. If the tool hit the time budget, the fix is usually to narrow the window. If it hit the record cap, the window is genuinely noisy and you may want to raise the cap or tighten the filters. Either way, the AI — or you — can tell at a glance which lever to pull next, instead of guessing whether a partial result is trustworthy.

TIP

Start with a tight window. A few hours of sign-ins is usually enough to confirm whether a spray is in progress, and a narrow range almost always completes well inside the budget. Widen the window only once you have signal and want to map how far back the activity goes.

What you can ask it

The roll-up shape fits several recurring questions beyond spray hunting, because each facet answers a different angle of the same data:

• Password-spray and brute-force hunting — distinct users per IP separates the two patterns and points you straight at the offending sources.
• Conditional Access failure triage — the failure-reason distribution shows whether failures are bad passwords or policy blocks, so you know whether you are looking at an attack or a misconfiguration.
• "Is anyone being sprayed right now?" — the spray_hunt preset answers this in a single call.
• "Which IPs are hammering us, and did any get in?" — top source IPs paired with the success-after-failure candidates turns volume into a prioritized list of accounts to check.

No extra setup

There is nothing new to configure. The tool reads sign-in logs through the standard Entra audit-log permission the InfraScout application already holds, so if your tenant is connected and identity assessments already work, sign-in aggregation works too. Like every mscloud_* tool it is agentless and read-only — it never changes state on the tenant, it only summarizes what the sign-in log already recorded.

Try it

Open an assessment against a connected tenant and ask the question directly — "is anyone being sprayed right now?", "which IPs failed against the most distinct users in the last six hours?", or "did any account that failed repeatedly from one IP then sign in successfully?" InfraScout runs the aggregation server-side and returns the faceted roll-up, ready to act on, in the same conversation where you are running the rest of the review.

Questions or feedback? Reach us at info@infrascout.cloud.