Search for Recent Authentication Failure in SFTP

Overview

Monitoring authentication failures in SFTP can help identify security risks, misconfigurations, and unauthorized access attempts. This guide explains how to search for authentication failures using AWS CloudWatch.

Azure Log Analytics Workspace

Steps to Search for Authentication Failures

1. Access Log Analytics Workspace:

• Open Azure Monitor > Logs.
• Select the relevant Log Analytics Workspace.

2. Run the Query:

AzureDiagnostics
| where Message contains "Authentication failed"

4. Filter by User (Optional):

AzureDiagnostics
| where Message contains "Authentication failed"
| where User == "username_here"

Replace username_here with the actual username.