Log incorrect login attempts or other failed attempts in a SIEM solution

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Experts,

Is it possible to log suspicions activities reactively to an external SIEM system for use cases such as:

  1. Too many failed login attempts
  2. Login without SSO
  3. Accessing the ISC tenant from a suspicious network and so on

Such events are ofcourse audited and one might find them using “search”, but could this be reactively logged into an external system? Did anyone already try this?

Thanks

Tamalika

2

Unfortunately these type of audit log events don’t have a corresponding event trigger that would allow you to push those events to your SIEM in an ever driven manner - your option is to basically “pull” from your SIEM using the search endpoints as you mentioned or have a workflow “push” them to your SIEM by running hourly (the most frequent allowed), hitting that search endpoints and pushing those audit events

3

Hi @mcheek , thank you for your response!

What do you mean by hourly being the most frequently pushes allowed? Would you please elaborate?

4

Workflow schedules can at most run at an hourly frequency

5

I see, so our plan to run the Workflow every minute will not work here :slight_smile:

Any other ideas how we could push such events “almost real time”? There is ofcourse running a script every minute on the VA which pulls this info… However, at this point, we are considering direct ISC integration opetions with Splunk.

6

There’s always the Shared Signals Framework that recently got transmit capabilities but not every tool is compatible with it nor does it necessarily have the events you care about

7

@tamalika01 with ISC splunk app SailPoint Identity Security Cloud AuditEvent Add-on for Splunk - Installation and User Guide - Compass this app use ISC search endpoint and you’ve all search events there including auth events (that should include passed and failed authentication).