3 Failed Login Report

1. Log in to the Oracle Cloud Infrastructure (OCI) Console using https://cloud.oracle.com as an Administrator.
2. Open the navigation menu and select Observability & Management.
3. Under Logging, select Search.
4. Click the Select logs to search field and then choose the compartment under which you want to search for user activity.
5. Click Show Advanced Mode to bring up the ability to enter free-text queries.
6. After clicking Show Advanced Mode, you will see a query based on the compartment you selected.
7. Press enter to go to the next line and paste the below query on that line:

   | where data.additionalDetails.eventId = 'sso.authentication.failure'
   | select data.additionalDetails.domainDisplayName as Domain, data.additionalDetails.actorName as 
   LoginUserName, data.additionalDetails.eventId as Result, data.additionalDetails.ssoRp as Provider, 
   time_format(datetime, 'yyyy-MM-dd hh:mm:ss z') as Date

8. Set the time frame for the report using Filter by time and click Search.
9. To export failed login report data, click the Actions button located on the right above the results table and select Export log data.