Authentication dashboards

The Authentication dashboard monitors authentication attempts to network devices, endpoints, and applications within the organization. Access protection is useful for detecting malicious authentication attempts, as well as identifying systems users have accessed in either an authorized or unauthorized manner.

The Authentication dashboard provides a summary of all authentication events. This summary is useful for identifying security incidents involving authentication attempts such as brute-force attacks or use of clear text passwords, or for identifying authentications to certain systems outside of work hours.

Dashboard filters

Use the available dashboard filters to refine the results displayed on the dashboard panels. The filters do not apply to key security indicators.

Filter Description
Time range Select the time range to view.
Business unit A group or department classification for the identity.
Category Filter based on the categories to which the host or user belongs.
App Filter based on authentication application.
User Filter based on user names.
Action Filter based on authentication success or failure.

Key indicators

gives an overview of account statuses. Use it to track newly active or inactive accounts, as well as those that have been inactive for a period of time but recently became active. Discover accounts that are not properly de-provisioned or inactivated when a person leaves the organization. As inactive accounts or improperly active accounts are vulnerable to attackers, it is a good idea to check this dashboard on a regular basis. You can also use this dashboard during an investigation to identify suspicious accounts and closely examine user access activity.

Key indicator Description
Authenticated sources Tracks the originating devices, clients, or systems that successfully initiated an authentication request.
Authenticated destinations Tracks the target hosts, devices, or applications (dest fields) where user login or authentication attempts are directed.
Authenticated users Provides a distinct count of users who are authorized on the deployment
Authentication attempts Total number of attempts that a user might have made to log in to the deployment

Dashboard panels

Panel Description
Inactive account usage Displays the count of authentication events over time by action.
Completely inactive accounts Displays the count of authentication events over time by app. For example, "win:local" refers to the local authentication performed on a Windows system and "win:remote" refers to remote API access.
Account usage by expired identities Displays a table of highest access counts by source. This table is useful for detecting brute force attacks, since aggressive authentication attempts display a disproportionate number of auth requests.
Default account usage over time by app Displays a table of the sources generating the highest number of unique user authentication events.
Default accounts in use Tracks the default and built-in operating system or device user accounts (such as admin, administrator, or root) that have a high number of login attempts across different hosts.
Default local accounts Tracks pre-installed, built-in system or operating system accounts (such as admin, administrator, root, or guest) that ship out-of-the-box with applications, devices, or platforms.
Geographically improbable accesses Tracks users who successfully log in from two distant locations in a time frame too short for normal travel.
Access anomalies by geolocation Tracks metrics that detect geographically improbable accesses (impossible travel) using authentication and firewall data.
Concurrent application accesses Tracks users who make multiple login attempts from different IP addresses within a very short time.