Logs
Logs show every authentication event your DC sensors report. Open Identity, then select Logs in the sidebar. The page is titled Access Logs.
You can also reach it from the Dashboard with View all access logs.
Columns
| Column | Description |
|---|---|
| Time | When the event happened. |
| Principal | The user or account that signed in. |
| Decision | Allow, Deny, or MFA required. |
| Protocol | Kerberos, NTLM, LDAP, or SMB. |
| Client IP | The source address of the sign-in. |
| Realm | The AD domain. |
| Reason / Error | Why the decision was made, or the error returned. |
| Correlation | An ID that links related events. |
Filters
| Filter | Options |
|---|---|
| Principal | User or account name. |
| Protocol | Kerberos, NTLM, LDAP, SMB. |
| Decision | Allow, Deny, MFA required. |
| Time range | The period to show. |
Two toggles reduce noise:
- Exclude intermediate — hides intermediate steps of a sign-in.
- Exclude benign noise — hides normal Kerberos pre-authentication codes (14 and 25).
Details drawer
Open the drawer to see:
- Failing sources — sources with repeated failures.
- Recent events — the latest events.
note
Logs show raw sensor events. When an identity source is in Monitor mode, every sign-in is allowed. The verdict a policy would have applied is not listed. Use Dry run on the Policies review step to test what a policy would do.
tip
No events at all? Check the Sensors and Protection columns on Identity Sources. A sensor counts as live only if it sent an event in the last 15 minutes. See Install the DC Sensor.