Endpoint device login failure attempt

Question

Hi, 
 
 Our client is having endpoint and server with XDR, Please let us know if there is a query or report available for User password failed attempt on Windows MAC and Linux systems. 
 Also is there an option for sending an alert for this to central admin email account. Please let us know if there is an alternative solution for this.

Qoosh · Accepted Answer

Hi Hemanth , 
 Thanks for reaching out to the Sophos Community Forum. 
 I was able to locate a query for Windows devices which may accomplish what you're looking for. - Live Discover Query - Brute Force Activity 
 An in-built query for Linux devices already exists: 
 For macOS devices, a "failed_login_count" identifier is present, however this only applies to "OpenDirectory". See "account_policy_data" in the following link. Live Discover/Response relies on the open source osquery schema for macOS. - osquery.io/.../5.3.0

Endpoint device login failure attempt

Top Replies