deepsecurity

DeepSecurity User Signed Off information logs

Hello、Does anyone know, I'm using Deep Security ver12.

I want to check the log of the user signed off information. The date when the user signed off from Deep Security Console.

I can see I signed off the lead on the DSM console, but I need to check it on the SQL Database Table for Audit.

I found only "dbo.clientsessions", is this right table that I need check?or not?

I also want to check API:160 "Authentication failure", and I can't find which table has informations.

Thanks for your help.

Solution

  • Try DB table clientsessions and I think legacy REST API (using username/password login) will also have log in the table.

    For authentication failure, you might use table systemevents if you want to AUDIT legacy REST API login/logoff. The values in Number field is likely:

    ...