Should you track failed login attempts and how ?

[Kandarp_Desai]

How important is it to configure an alerting/incident for failed login attempts to the Palo Alto Panorama or Firewalls.

This is for:

(1). SAML based authentication (2). Local logins. 

Should both of them be tracked and do we need to monitor the system logs for any particular "event" for both of them ?

[akuzhuppilly]

Hello @Kandarp_Desai 

I would say it depends on your company's security guidelines. However, there's nothing wrong with monitoring failed authentication attempts.

[Kandarp_Desai]

Thanks !!

[SutareMayur]

Hi @Kandarp_Desai 
And in order to track down it, you can monitor the system logs for the event id 'auth-fail'. 

You can also enable email alerts for this event from the 'Log Settings' section under 'Device' Tab.

Hope it helps!