Should you track failed login attempts and how ?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Should you track failed login attempts and how ?

L2 Linker

How important is it to configure an alerting/incident for failed login attempts to the Palo Alto Panorama or Firewalls.

This is for:

(1). SAML based authentication (2). Local logins. 


Should both of them be tracked and do we need to monitor the system logs for any particular "event" for both of them ?


L4 Transporter

Hello @Kandarp_Desai 

I would say it depends on your company's security guidelines. However, there's nothing wrong with monitoring failed authentication attempts.


Network Security Engineer

Thanks !!

Cyber Elite
Cyber Elite

Hi @Kandarp_Desai 
And in order to track down it, you can monitor the system logs for the event id 'auth-fail'. 

You can also enable email alerts for this event from the 'Log Settings' section under 'Device' Tab.


Hope it helps!


  • 3 replies
  • 29 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!