Notification of failed login attempt
Answered
Hi,
We are working on a tender that requires immediate notification of any failed login attempt, to the IT department as a cybersecurity measure.
How can I get NxWitness to notify me by email or Mobile notification about a failed login attempt to my system?
The information of the attempt is logged in the Audit Trail, but I don't see anyway to create an event based on a failed or successful attempt.
-
Hi Miguel Câmara,
There is no default option in Nx to send an email or push notification in case of a failed login attempt, however, it can be created by anyone with a bit over developer skills through the API by polling the audit trail every N time.
Below, an example of the Audit trail API output:
{
"error": "0",
"errorString": "",
"reply": [
{
"createdTimeSec": 1704981119,
"rangeStartSec": 1704981119,
"rangeEndSec": 0,
"eventType": "AR_Login",
"resources": [],
"params": "",
"authSession": {
"id": "{8f6d2947-650d-43ec-964d-9d2171a9dd3d}",
"userName": "<XXXXXXXXXXX>",
"userHost": "192.168.178.110",
"userAgent": "Nx Meta/5.1.2.37996"
}
},
{
"createdTimeSec": 1704981246,
"rangeStartSec": 0,
"rangeEndSec": 0,
"eventType": "AR_UnauthorizedLogin",
"resources": [],
"params": "",
"authSession": {
"id": "{14913fe0-5301-4d10-9395-73a6a6f23ea1}",
"userName": "<XXXXXXXXXXX>",
"userHost": "127.0.0.1",
"userAgent": "Nx Meta/5.1.2.37996"
}
}
]
}So, what should be done is checking for the value of eventType. Where AR_Login is valid and AR_UnauthorizedLogin is invalid.
Then they can trigger an email server or push notification / sms service, but perhaps it is easier to send an Generic Event back to the VMS, and the VMS can send the email and/or push notification, etc. An HTTP server is fairly easy to setup within an 3rd party application.
-
Hi Norman,
Thank you for the "recipe" for the API, it will be helpful and I will try to implement it. I am more comfortable with NodeRed these days, easy to create a working solution with it.
However, I really wish this was developed to be a System Trigger for standard NxWitness Systems, since it is already triggering the write to Audit, should be "simple" to also trigger a System Event.
-
Hi Miguel Câmara,
Certainly! I've taken note of your message, and while I appreciate your input, it's important to mention that I don't anticipate any changes on a short notice. If you have any further concerns or suggestions, please feel free to share them in the Feature Feedback section.
JIRA-VMS-47374
Post is closed for comments.
Comments
3 comments