Hello !
I'm trying to receive the authentication faillure and success from my devices but i'm having few complications..
From my windows devices, it's ok, i'm able to receive log out / in / failled , with winlogbeat
but from linux i'm lost. I'm trying with auditbeat and i can have 'authentication success' from event.type, but i can't find authentication failed...
when i check the var/log/btmp, it's empty, i tried to faille my login session few times, but i have still nothing.
Can someone help me ?
thank you