Failed Logins

The Failed Logins check detects failed login attempts with timestamp, user, and origin. It runs every 15 minutes on Windows, Linux, and macOS.

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → Failed Logins.
3. Adjust the periods and minimum counts if needed.
4. Click Add Check.

For assignment and required permissions, see Assign checks with config packages.

Settings

Results

For an alert, inspect the user, origin, and time in the result. The result lists up to the 25 most recent events. Repeated diagnostic lines for the same SSH connection are collapsed, while different connections or boots remain distinct.

Platform differences

On Windows the check reads event 4625 from the Security log; on macOS it reads the unified log. On Linux it prefers lastb/btmp. If lastb is unavailable on Debian or another systemd distribution, it instead reads the journal for sshd, sshd-session, and sshd-auth, plus PAM authentication failures from the auth logs; no extra configuration is required. Journal access errors are reported as query failures rather than an incorrect zero-attempt result. If neither lastb nor journalctl is available, or the btmp file is missing, the check reports Warning.

On Windows, the check ignores failed logons of the device's own computer account from the device itself. Failures caused by unreachable logon servers, clock skew, or internal or unspecified errors count only toward the warning there, not toward the critical period.