DeepSecurity User Signed Off information logs

Question

Hello、Does anyone know, I'm using Deep Security ver12.

I want to check the log of the user signed off information. The date when the user signed off from Deep Security Console.

I can see I signed off the lead on the DSM console, but I need to check it on the SQL Database Table for Audit.

I found only "dbo.clientsessions", is this right table that I need check?or not?

I also want to check API:160 "Authentication failure", and I can't find which table has informations.

Thanks for your help.

Answer 1

Try DB table clientsessions and I think legacy REST API (using username/password login) will also have log in the table.

For authentication failure, you might use table systemevents if you want to AUDIT legacy REST API login/logoff. The values in Number field is likely:

• 600 User Signed In
• 601 User Signed Out
• 608 User Session Validation Failed
• 675 API Key Session Validation Failed

...