some file

Authentication Activity

The Authentication Activity report shows how your users signed in during a period: how many logins succeeded, how many failed and why, and the sign-in history of each user. Use it for access reviews and to spot accounts with repeated failures. Open it from Activity > Reports.

The report is built from the User logged in (user.login) and User failed login (user.failedlogin) events.

Only administrators can open Activity. The report lists users by name and e-mail address. On a self-hosted server, log-in events need the built-in identity provider and the service account it was given at install.

Create an Authentication Activity report

  1. Go to Activity > Reports and click Create Report.
  2. Leave Authentication Activity as the Report Type. It is the default.
  3. Choose the Date Range. The default is the last two weeks.
  4. Optionally pick Groups to limit the report to their users. Leave it empty for all users.
  5. Click Save.

The report appears in the table when it is ready. Click the eye icon to view it, or the download icon to save it as a PDF. See Reports for the table and the dialog.

What the report shows

An Authentication Activity report with Total Logins 5, Successful 5, a per-day chart of successful and failed logins, Total Failed Logins 0, and a Users list with five example users, their Session Time and Last Seen

ItemWhat it shows
Total LoginsAll login attempts in the period.
SuccessfulSuccessful logins, with their share of the total.
Login chartSuccessful (green) and failed (red) logins per day.
Total Failed LoginsFailed logins, with a pie chart of the failure reasons.
UsersEvery user with their Session Time and Last Seen. Use Search for user activity to find one.

Click a user to see the same totals and chart for that user, and their Authentication Activity list with the Date/Time and Activity (User logged in or User failed login) of each event.

Review failed logins

  1. Generate the report for the period you review, for example the last week.
  2. Check Total Failed Logins and the reasons in the pie chart.
  3. Expand the users with failed logins and read their event list.
  4. For the full details of a failure, filter Activity > Events by the User failed login type. The event carries the reason; for a setup key the reason is expired, revoked, over used or key not found.

Account lockout, password and multi-factor rules are set in your identity provider, not in Netzilo. To alert on failed logins, stream events to your SIEM with Event Streaming.

Use the API

Create the report with POST /api/reports and "report_type":"authentication". See Reports.

Troubleshooting

The report shows no logins. No user signed in during the period, or the users are not in the selected groups. On a self-hosted server, also check that the built-in identity provider is healthy, since log-in events come from it.

  • Reports - Create, view, download and delete reports
  • User Activity - User behaviour and events per category
  • Events - Filter User logged in and User failed login events
  • Authentication - Peer login and inactivity expiration settings
  • Event Streaming - Send login events to your SIEM