Unknown Login Attempts

[Jatin.Singh]

I'm noticing several failed login attempts to our firewall for my domain admin account username.  This does not actually exist on our firewall as a user, and as such is being rejected.   I only log into our firewall using HTTPS access, i occasional use SSH, but have not for any of the events shown in the screenshot provided.

The logins seem to occur just after 9AM, 12PM and 4PM each day.  Is it possible that this is a false positive event on the Palo Alto, or that my windows desktop is somehow compromised?

how do we check that?

[OtakarKlier]

Hello,

I would say it is not a false positive since its a log, e.g. something the PAN is detecting. DO you have a scanner running using your credentails? I would find that device with that IP address and see why its doing what its doing.

Regards,