Just stumbled on this while reviewing our Delinea PAM audit logs. Turns out you can configure a workflow to run automatically when a failed login event is detected. This is a game-changer for automating security responses, and I'm surprised it's not talked about more.
I was poking around in the `Workflows` section under `Administration`, and there's a trigger type called "Event-Based." You can select specific events like `Privileged Access Manager: Authentication Failure`. From there, you can chain actions like:
* Sending a detailed alert to a Slack channel or SIEM.
* Creating a high-priority ticket in ServiceNow.
* Temporarily restricting the source IP (if integrated with your network gear).
Here's a simplified version of the JSON payload you can send to a webhook:
```json
{
"event_type": "AUTH_FAILURE",
"source_ip": "{$event.sourceIp}",
"username": "{$event.username}",
"target_system": "{$event.resourceName}",
"timestamp": "{$event.timestamp}"
}
```
This means you can go beyond just logging failures to actually *doing* something about them in real time. Has anyone else set this up? I'm curious about:
* What kind of actions have you automated?
* Any pitfalls with false positives from typos?
* Is there a way to throttle the workflow if you get a burst of failures from a single source?
Thinking this could also be useful for *successful* logins from unusual geolocations. The event triggers seem really powerful for building a more reactive security posture.
--diver
Data is the new oil - but it's usually crude.
Totally agree, this is one of those powerful features that gets buried in the admin panels. We set this up for our Kubernetes dashboard logins a while back.
One thing I'd add - make sure you tune the sensitivity. If you're firing a workflow for every single failed login, a simple typo from an admin can spam your ticketing system. We added a small filter to only trigger after 3 failures from a new IP within 5 minutes. It cut down the noise dramatically.
What's your experience been with the alert fatigue? Have you found a good threshold that catches real threats without drowning you in false positives?
K8s enthusiast
Whoa, that's cool. I've only ever used workflows for project stuff, like auto-assigning tasks. I never thought about using them for security.
Does this work with other systems too? Or is it only for Delinea? Asking because we use a different PAM tool at my place.
The idea of auto-creating a ticket is smart. Do you find ServiceNow gets flooded, or is it manageable?
Still learning.
The JSON payload's placeholder syntax looks wrong for Delinea. Shouldn't the variables be `{event.sourceIp}` without the dollar sign? That's a common misstep that'll cause the workflow to fail.
Also, tying a workflow directly to every single `AUTH_FAILURE` event will spike your monthly Delinea workflow run costs. Their pricing is per execution.
Add a rate limit filter in the trigger config itself, or you're just burning money on typos.
cost per transaction is the only metric