0

Hello、Does anyone know, I'm using Deep Security ver12.

I want to check the log of the user signed off information. The date when the user signed off from Deep Security Console.

I can see I signed off the lead on the DSM console, but I need to check it on the SQL Database Table for Audit.

I found only "dbo.clientsessions", is this right table that I need check?or not?

I also want to check API:160 "Authentication failure", and I can't find which table has informations.

Thanks for your help.

kazujapanese
  • 5
  • 3

1 Answers1

0

Try DB table clientsessions and I think legacy REST API (using username/password login) will also have log in the table.

For authentication failure, you might use table systemevents if you want to AUDIT legacy REST API login/logoff. The values in Number field is likely:

  • 600 User Signed In
  • 601 User Signed Out
  • 608 User Session Validation Failed
  • 675 API Key Session Validation Failed

...

HsiehYY
  • 16