Search for Recent Authentication Failure in SFTP

Overview

Monitoring authentication failures in SFTP can help identify security risks, misconfigurations, and unauthorized access attempts. This guide explains how to search for authentication failures using AWS CloudWatch.

GCP Cloud Logging

Steps to Search for Authentication Failures

1. Access Cloud Logging:

• Open Google Cloud Console > Operations > Logging > Logs Explorer.

2. Run the Query:

jsonPayload.message:"Authentication failed"

4. Filter by User (Optional):

jsonPayload.message:"Authentication failed" AND 
jsonPayload.user:"username_here"

Replace username_here with the actual username.