https://live.paloaltonetworks.com/t5/globalprotect-discussions/understanding-pre-logon-logs/m-p/597728#M5817 <P>I'm trying to understand the global protect logs I am seeing.</P> <P>&nbsp;</P> <P>I see bad actors from various countries trying to brute force username/passwords.&nbsp;</P> <P>&nbsp;</P> <P>I always see 2 logs per attempt. 1 Portal-auth Login Failure, and 1 portal-prelogin before-login success.&nbsp;</P> <P>&nbsp;</P> <P>Prelogin should be setup to require a cert so I'm not sure why it's saying portal-prelogin before-login success. Any ideas</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Verac22_0-1726172808735.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/62219i3C219BC49759D6D6/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="Verac22_0-1726172808735.png" alt="Verac22_0-1726172808735.png" /></span></P> <P>&nbsp;</P> Thu, 12 Sep 2024 20:26:57 GMT Verac22 2024-09-12T20:26:57Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/understanding-pre-logon-logs/m-p/597728#M5817 <P>I'm trying to understand the global protect logs I am seeing.</P> <P>&nbsp;</P> <P>I see bad actors from various countries trying to brute force username/passwords.&nbsp;</P> <P>&nbsp;</P> <P>I always see 2 logs per attempt. 1 Portal-auth Login Failure, and 1 portal-prelogin before-login success.&nbsp;</P> <P>&nbsp;</P> <P>Prelogin should be setup to require a cert so I'm not sure why it's saying portal-prelogin before-login success. Any ideas</P> <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Verac22_0-1726172808735.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/62219i3C219BC49759D6D6/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="Verac22_0-1726172808735.png" alt="Verac22_0-1726172808735.png" /></span></P> <P>&nbsp;</P> Thu, 12 Sep 2024 20:26:57 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/understanding-pre-logon-logs/m-p/597728#M5817 Verac22 2024-09-12T20:26:57Z