Security logs is the record of sign in activity in SESTEK AgenticCX. Every successful sign in, failed attempt, account lockout and "log in with this user" (impersonation) event is stored here with the time, the IP address, the browser and the user. Use it to check who signed in and when, to investigate failed attempts, and to see when someone signed in as another user.
Open it from Administration, Identity management, Security logs. The page is read only: you can search and read, nothing on it can be changed or deleted. For a record of what users did inside the product, see Audit Logs. For live operational numbers, see the Dashboard.
Watch the walkthrough
What you can do on this page
| Action | What it does |
|---|---|
| Browse the log | See sign in events, newest first, ten per page |
| Filter | Narrow the list by time range, application, identity, username, action, client, correlation ID or IP address |
| Search | Applies the filters you typed |
| Clear | Empties all filters and shows the full list again |
You need the Security logs permission in the Identity management group (see Roles and Permissions). The built-in admin role has it.
Filter the log
The filter card has nine fields. Nothing is applied until you choose Search.
| Field | What to enter |
|---|---|
| Start time / End time | Pick a date from the calendar. It has month and year drop downs and an hour and minute selector. Leave both empty to see the whole history |
| Application | The application that wrote the event |
| Identity | The identity source of the event |
| Username | The user the event belongs to |
| Action | The event type, for example LoginFailed |
| Client | The client that requested the sign in |
| Correlation Id | The identifier of one event |
| IP address | The address the request came from |
The text fields look for the complete value you type, not a part of it. In the lab, LoginFailed finds failed attempts, while Login finds nothing. Copy the value from a row if you are not sure how it is spelled. Filters combine: an event must match every field you filled.
To look back further, set a start time and an end time and choose Search. The total count appears at the bottom left of the table.
Read the table
| Column | What it shows |
|---|---|
| Date | When the event happened |
| Action | The event type |
| IP address | The address the request came from |
| Browser | The browser and operating system the user had |
| Application | The application that recorded the event |
| Identity | The identity source |
| Username | The user the event belongs to |
| Client | The client behind the event. It is empty for a normal sign in |
| Correlation Id | A unique identifier of the event |
The table is wider than the screen, so scroll to the right to reach Username, Client and Correlation Id. Long values such as the browser string are cut off in the cell. Results come ten per page, with the page numbers and the total at the bottom. There is no setting for the page size. Clicking a row does not open a detail view, because every value is already in the row.
Action names you will see
| Action | Meaning |
|---|---|
LoginSucceeded | A user signed in |
LoginFailed | A sign in attempt failed |
LoginLockedout | A sign in was refused because the account was locked out |
ImpersonateUser | An administrator signed in as another user. The Client column shows AgenticCX_App |
Other action names may appear if your environment records more event types.
Common tasks
Find failed sign in attempts
Type LoginFailed in Action, set a start time if you want to look back, and choose Search.
See when someone signed in as another user
Type ImpersonateUser in Action and AgenticCX_App in Client, then choose Search. The Username column shows who performed the sign in.
Find a single event
Every event has a correlation ID. Copy it from the Correlation Id column, paste it into the Correlation Id field and choose Search. One row remains.
Find account lockouts
Type LoginLockedout in Action and choose Search.
Move through the pages
Use the page numbers or the arrows at the bottom. The first and last page buttons jump to the ends.
Open the log from the Users page
On the Users page, the Actions menu of every row has a Security logs entry. It opens this page. The Username filter is not filled in for you, so type the user name and choose Search.
Good to know
- The page is read only. There is nothing to edit, export or delete here.
- IP addresses and browser strings in the log belong to real users. Treat the page as sensitive and grant the permission only to administrators.
- Filters apply only when you choose Search. Changing a field without searching leaves the old results on screen.
- If a search returns nothing, check that the value matches exactly, including upper and lower case letters.