PCI - Failed Access Attempt Detection
Description
Privileged Account Activity policy monitors and tracks targeted users' activities on the cloud accounts. The policy allows configuration on which user and what type of activities to be monitored.
Policy Configuration
Follow the steps below to enable and configure the policy
- Click on any Cloud Account drop down menu from FortiCASB dashboard, e.g. Salesforce, Office365, etc.
- Click on Policy drop down menu and select Compliance, then select PCI-DSS tab.
- Locate PCI - Failed Access Attempt Detection and click on the right arrow key > button to expand the policy.
- Click on General tab, click Status toggle switch button to enable the policy.
- Click on Severity level drop down menu to select the severity level (Critical, Alert, Warning, Information).
- Click Context tab to configure settings.
- In Login Attempts, enter the threshold for the number of failed login attempts before an alert is generated.
- In Interval (minute), enter the time frame for all failed login attempts before an alert is generated.
- Click Save to update the configuration.
Note: this policy generates both alert in Alert page and data in Compliance Report.
For example, given an interval of 3 minutes and login attempts of 5. If a user had more than 5 failed login attempts in 3 minutes, an alert will be sent to inform on the suspicious login attempts on the cloud account.
|
After the policy is enabled and configured, whenever there are excessive failed login attempts on the cloud account, an alert will be triggered in the alert page. For more details, please refer to Alert. Compliance report will also record any alerts generated by this policy, for more details, please see Compliance Report. |