Authentication dashboard

The Authentication dashboard monitors authentication attempts to network devices, endpoints, and applications within the organization. Access protection is useful for detecting malicious authentication attempts, as well as identifying systems users have accessed in either an authorized or unauthorized manner.

The Authentication dashboard provides a summary of all authentication events. This summary is useful for identifying security incidents involving authentication attempts such as brute-force attacks or use of clear text passwords, or for identifying authentications to certain systems outside of work hours.

Dashboard filters

Use the available dashboard filters to refine the results displayed on the dashboard panels. The filters do not apply to key security indicators.

Filter	Description
Time range	Select the time range to view.
Business unit	A group or department classification for the identity.
Category	Filter based on the categories to which the host or user belongs.
Action	Filter based on authentication success or failure.
Destination	Filter by the target host, device, or system where the authentication attempt or login is directed.
Source	Filter based on authentication application.
User	Filter based on user names.
App	Filter based on authentication application.
Special access	Filter restricts and highlights authentication events tied to privileged, administrative, or elevated user accounts.
Watchlisted user	Filters by a user identity that has been explicitly added to a tracking list (watchlist) because they require closer monitoring or pose a higher potential security risk.

Key indicators

Gives an overview of account statuses. Use it to track newly active or inactive accounts, as well as those that have been inactive for a period of time but recently became active. Discover accounts that are not properly de-provisioned or inactivated when a person leaves the organization. As inactive accounts or improperly active accounts are vulnerable to attackers, it is a good idea to check this dashboard on a regular basis. You can also use this dashboard during an investigation to identify suspicious accounts and closely examine user access activity.

Key indicator	Description
Authenticated apps	Tracks the specific software applications, services, or system processes (such as SSH, Active Directory, VPN portals, or web services) that users successfully logged into or accessed during the recorded authentication events.

Dashboard panels

Panel	Description
Authentication search	An ad-hoc, interactive search tool used to query and investigate raw authentication and login events across your environment.
Authentication events	A summary of login and access attempts recorded across your network and applications.