08-22-2023 07:21 AM
How important is it to configure an alerting/incident for failed login attempts to the Palo Alto Panorama or Firewalls.
This is for:
(1). SAML based authentication (2). Local logins.
Should both of them be tracked and do we need to monitor the system logs for any particular "event" for both of them ?
08-22-2023 09:03 PM
Hello @Kandarp_Desai
I would say it depends on your company's security guidelines. However, there's nothing wrong with monitoring failed authentication attempts.
08-28-2023 05:58 PM
Hi @Kandarp_Desai
And in order to track down it, you can monitor the system logs for the event id 'auth-fail'.
You can also enable email alerts for this event from the 'Log Settings' section under 'Device' Tab.
Hope it helps!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
