Count the unique users who are triggering the breached password admin notifications

Problem statement

How can we get the number of unique users who are triggering the breached password admin notifications?

Solution

You will need to count the users yourself by exporting the logs. You filter events by type:pwd_leak for breached password events only and count the number of unique user_id values.