All Apps and Add-ons

Problem on collect of Firewalls failed authentication events



For security monitoring matters, we are trying to collect authentication logs from Fortigate and Palo Alto devices but we only receive success events. We also need to get failed events.

We don't think the problem is due to devices configuration because other SIEM can read failed authentication events with the same Log forward filters applied.

Same for




Thanks by advance for your feedback

Labels (3)
0 Karma


Hi @yanisA,

Let me understand:

  • you're receiving Fortigate and Palo Alto logs,
  • the same systems (with the same configuration) are sending all logs (success and failed authentications) to another SIEM,
  • Splunk is receiving only success logs;

is it correct?

one question: are you receiving only success events or can you identificate only success events?

If you receive only success events there are two choices:

  • the source systems are configurated to send only success events and don't trace failed events;
  • all the events arrive in Splunk but all the events except success, are discarded.

In the first case you can work only on the source systems.

In the second case, you have to check the configuration files (on Indexers and Heavy Forwarders) related to the sourcetypes of Fortigate and Palo Alto and verify if there's a filter that discards a part of events.

If instead you aren't able to identify events, you have to analyze the documentation of Fortinet and Palo Alto to find the related messages.

Installing the Technical Add-Ons (TA) of Fortigate and Palo Alto, will help you in this job.




Hi @gcusello

Thanks for your response 🙂

Exactly, your understanding is good. We are going to check the configuration files related to the sourcetypes, both TA are already installed.

I will come back to you soon


0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...