IAM Event - Multiple Authentication Failures

Event

Authentication Failures - Any connected SaaS Application - Sent as a result of six authentication failures events or more within 10 minutes.

Recommended action

Contact the customer or user and make them aware of this event. This event indicates a possible account compromise by an unauthorized actor due to repeated login failures within a minimal time frame. It is recommended to reset the password to a complex password and enable MFA if not already enabled.

Alert type

Alert