Security Analytics

A dedicated view for authentication-event health — successful and failed logins, the reasons behind failures, password-reset activity, MFA outcomes, and account-protection signals. Use it to spot abuse patterns, weak factor configurations, and infrastructure regressions before they reach the helpdesk.

Access: Admin Console → Insights → Security Analytics. If the feature is not enabled on your tenant, contact support@loginradius.com.

---

Modules

Pick a module to drill into one slice of authentication health. Each tab shows the headline counts on top and a trend chart below — successful events in green, failures in red.

Login Activity

Total login volume split into Successful and Failed. Filter by Login factor (Email, Passkey, Social Login) to isolate one channel.

210

Total

199(94.76%)

Successful

11(5.24%)

Failed

Failed Login Reasons

11

Total failures

4(36.4%)

Username or password wrong

4(36.4%)

User id locked

2(18.1%)

OAuth invalid grant

1(9.1%)

Provider required error

Password Reset

Reset-flow health. The Failed Reset Reasons sub-chart explains why a reset link could not be redeemed — typically token expired or already used.

15

Total

14(93.3%)

Successful

1(6.7%)

Failed

Failed Reset Reasons

1

Total failures

1(100%)

Token expired

MFA Overview

Multi-factor challenges issued, succeeded, and failed. Filter by factor to compare email OTP, authenticator-app, and SMS outcomes. Failed MFA Reasons highlights wrong codes, expired challenges, and locked factors.

816

Total

789(96.7%)

Successful

27(3.3%)

Failed

Failed MFA Reasons

27

Total failures

15(55.5%)

Wrong code

8(29.6%)

Code expired

3(11.1%)

Factor locked

1(3.7%)

Too many attempts

---

Protections

Background guards that block abusive sign-in attempts before they reach your application. Each tab shows the daily count of events the guard intercepted — a flat-zero baseline is the expected state.

Brute Force

Repeated authentication attempts from the same credential, IP, or account that exceeded the configured threshold are blocked at the gate.

Breached Password Protection

Sign-in attempts using credentials known to be exposed in third-party breach datasets are flagged and blocked before the password is accepted.

Bot Protection (CAPTCHA)

Requests that failed the CAPTCHA challenge — most often automated bots probing the sign-in or sign-up forms.

Failed Auth from Restricted Domains

Sign-in and sign-up attempts blocked because they originated from a disposable, blacklisted, or otherwise restricted email domain.

---

Controls & Actions

Two controls scope what the page shows and produce a shareable snapshot: Date Range bounds every chart on the page, and Export downloads the current view as a PDF.

Date Range

The date range at the top of the page bounds every chart in Security Analytics. Click either input to open the picker.

Minimum

15 minutes

Maximum

7 days

Timezone

Account-configured

Two date-time inputs separated by an arrow. Click either to open the picker.

Export as PDF

Click Export at the top right of the page to download the current view as a PDF — every chart, with the active date range stamped at the top. Use it for incident write-ups, compliance reviews, and sharing with stakeholders.

The Export button sits in the top right of the page header.

---

Best practices

Watch the failure ratio, not just the count

A small absolute number of failures on a low-traffic day can still be alarming if the ratio crosses 5–10%. Always compare Successful vs Failed proportionally.

Cross-reference with Platform Analytics

If failed logins spike, switch to Platform Analytics → Top 5 by IP in the same window to identify the offending clients.

Tune MFA factor mix on real outcomes

Compare failure rates across MFA factors before rolling out a default. Email OTP failures dominated by "expired" suggest tightening the TTL is wrong — users need more time, not less.

Treat protection spikes as signal, not noise

Brute Force or Breached Password spikes are often the first sign of a coordinated attack. Investigate IPs immediately and consider tightening thresholds for the duration.

Related Resources

Platform AnalyticsUser AnalyticsAcceptable Use Policy