idea Webhook for Failed logins in ArcGIS Enterprise Ideas

Webhook for Failed logins

Dan_Brumm — Thu, 17 Oct 2024 14:00:43 GMT

I would like to have a webhook that fires when a user tries to login but fails.

1. We have security scans that are run and they automatically attempt to login over and over. It would be cool to be able to flag this activity without having to look at the logs.

Re: Webhook for Failed logins

KevinHibma — Tue, 05 Nov 2024 22:18:52 GMT

Interesting idea. I understand the request from the webhook side, but I'm not sure a webhook is the best mechanism for this particular event. I'll bring it to the team and chat about it.

The upcoming Enterprise 11.4 release will introduce audit logging in the portal. I realize you're looking for something beyond logs, but these audit logs will be very focused on security events and might provide the focused information you're after.

Re: Webhook for Failed logins

Dan_Brumm — Wed, 13 Nov 2024 17:38:41 GMT

Yeah, you are probably correct about webhooks not being the best choice. Those audit logs seem like a really good option. I was using a script to parse my Portal logs every 15 minutes and write back all kind of events like failed and successful logins to a table. It works but it's kind of clunky. I was able to move most of that work over to webhooks and my notebook server which worked for 99% of my needs but the failed logins.