topic Re: Should you track failed login attempts and how ? in Panorama Discussions

Should you track failed login attempts and how ?

Kandarp_Desai — Tue, 22 Aug 2023 14:21:17 GMT

How important is it to configure an alerting/incident for failed login attempts to the Palo Alto Panorama or Firewalls.

This is for:

(1). SAML based authentication (2). Local logins.

Should both of them be tracked and do we need to monitor the system logs for any particular "event" for both of them ?

akuzhuppilly — Wed, 23 Aug 2023 04:03:26 GMT

I would say it depends on your company's security guidelines. However, there's nothing wrong with monitoring failed authentication attempts.

Kandarp_Desai — Mon, 28 Aug 2023 15:39:04 GMT

Thanks !!

SutareMayur — Tue, 29 Aug 2023 00:58:09 GMT

Hi @Kandarp_Desai
And in order to track down it, you can monitor the system logs for the event id 'auth-fail'.

You can also enable email alerts for this event from the 'Log Settings' section under 'Device' Tab.

Hope it helps!