Login failed audits

[FranciscoS]

Dear community,

My company is requesting to have audit logs for our Saviynt tool such as Logins (both success and failed) with username, timestamp, IPaddress...

From the tool, I was able to find the feature Admin Functions -> Saviynt Usage where you can find successful logins with URLs accessed by the different Saviynt users with timestamp and IP ADDRESS information.

However, we do not know where to find failed logins where we can check that someone is attempting to compromise an account. We have inspected Saviynt logs but there is not enough information...

Do you know where to check this security concern?

Many thanks in advance!

Kind regards

[pruthvi_t · Accepted solution]

Hi @FranciscoS ,

Greetings.

Do you have SSO enabled on your environment??

If yes, then admin function wouldn't show that information as it logs information of only when user is successfully logged in and accessed URLS.

However we have 'Recent security activity' tab in the home page, when you click user icon on top right corner, you can find that information with time stamp on last failed login attempt etc.,

Please refer to below documentation link

https://docs.saviyntcloud.com/bundle/EIC-User-v24x/page/Content/02-get-strt-with-eic/eic-intr-mod-ex...

Thanks, 

[FranciscoS]

Hello Pruthvi,

Thanks for your prompt reply. Yes, we have SSO enabled. However, when the login is forced to fail giving a valid account into idP but an invalid identity for the tool, Saviynt tool gives an answer as 'authentication has failed': 

So for my understanding, this event should be traced by Saviynt anyhow.

On the other hand, I have checked your indications regarding 'Recent security activity' tab in the home page and only the 'last successful login' is visible:

I hope you can help me, please.

Kind regards.

[rushikeshvartak]

Only way you can find is from users table failedlogonattempts but it gets reset after next successful login