The Audit > Security section records login attempts to the platform: who tried to log in, how they did it, from which IP address, and whether they succeeded. This article explains how to review these attempts, interpret the results, and export them.
Access the section
- In the side menu, go to Audit.
- On the Audit page, click the Security card.
- Review the Login attempts table.
By default, the table shows failed and blocked attempts from the last 30 days, which require attention. You can extend the period with the dates and also see successful attempts, or all, with the Result filter.
To view the Online help for this section, click the i icon in the top right corner.
Filter the attempts
- In Start Date and End Date, enter the period you want to review.
- In Result, choose one of these options:
- Failed and blocked (default option)
- Blocked
- Successful
- All
- Click Filter.
You can also use the Filter by user and Filter by IP fields in the table to narrow down the results.
The table shows the Date, User, Result, Reason, Method, and IP columns. Use Show to choose how many records to display per page.
Interpret the result
- Successful: the user logged into the platform.
- Failed: the login was not completed, for example due to an incorrect username or password, an incorrect verification code, or an inactive user.
- Blocked: the platform stopped the attempt because failed attempts accumulated, either from a password or verification code. Access is automatically enabled again after a few minutes.
The Reason column shows the cause of the result. For example: The identity provider did not complete the login.
The attempt that caused the block is logged. Those that arrive while it lasts are not logged.
Interpret the User column
- When the input corresponds to an organization user, that user is displayed and you can open their Profile.
- When it does not correspond to any user, No user is shown and the input is not displayed. It is often a password mistakenly entered in the username field.
Logins with an identity provider: when the user logs in through a provider such as Microsoft Entra ID, Google, or Okta, the platform only logs what happens on its side. Failed attempts at the provider are checked with the provider itself.
Export the attempts
- Apply the filters you need.
- Click Export.
- Choose the Excel or CSV format.
The file includes the attempts that match the applied filters.
💡 Best practices
- Regularly review failed and blocked attempts to detect suspicious access.
- If the same user accumulates blocks, check with them whether they forgot their password or do not recognize those attempts.
- Pay attention to attempts from unknown IP addresses or attempts repeated within a short period.
- If your organization uses an identity provider, complement this review with the provider's sign-in logs.
- Export the attempts before sharing them with your security team, so you keep a record of the period analyzed.