Getting Data In

Cisco ASA Logging of Bad Password Attempts

prosyspath
New Member

I am trying to log "Bad Passwords" or "Access Denied" attempts on the ASA and alert on them with Splunk:

I have the Cisco ASA 5510 Syslog setup and pointed to Splunk and I am getting data into Splunk but cannot search and see find the bad password attempts. I am running Cisco 8.2.1 I have changed the logging trap warnings to notifications with no effect.

logging enable
logging console notifications
logging trap warnings
logging device-id hostname
logging host inside 10.1.100.110

Tags (2)
0 Karma

krugger
Communicator

You should be looking for:

%ASA-6-605004: Login denied from source-address/source-port to interface:destination/service for user “username”

%ASA-6-605005: Login permitted from source-address/source-port to interface:destination/service for user “username”~

Log level has to be set to informational. Event ID is 605004.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...