Monitoring a series of invalid login attempts on different user IDs from the same IP address (security monitoring)

[Brett_Booz]

We are trying to be proactive about analyzing our invalid user attempts to see if anyone is systematically "spraying" our system with valid user IDs paired with commonly used passwords. To do so it would be helpful to know the IP address of the machine making those attempts. Is that stored anywhere in the database? I found the registeredusers and loggeduser tables, but that would only be helpful after a valid attempt had been made (e.g. registration is successful at some point). What we're really looking for is a series of invalid login attempts on different user IDs from the same IP address. Any ideas?

[AdamShaneHyland]

Hi Brett,

We don't track the workstation name or ip address of failed login attempts.  However, you can be view the current failed login attempts in the Security Transaction log (Client | Admin | Transaction Logs | Transaction Log: Security | Check "Show Details" | Action: Login Failure).  While this doesn't track the attempting workstation name or IP address, it will give you the ability to audit the attempt by the OnBase user.

I created SCR: #287354 to track this request.  Specially, to add the workstation name and IP address to the message when a login failure occurs.

Take care.