QUESTION

I see Panther audit logs capture a SIGN_IN action. Does Panther record failed login attempts as SIGN_IN audit logs, or only successful logins?

ANSWER

Panther only records successful SIGN_IN events in the audit logs at this time. Failed login attempts are not logged as Panther audit logs.

If you'd like to see failed SIGN_IN events recorded in Panther audit logs, please reach out to Panther Support to submit a feature request.