Investigating user searches

See whether any users are searching for passwords. As an administrator, I want to know if a user is attempting to access to another users password.


  1. Click the navigation menu icon, and then select Searches from the list.
  2. On the Searches page, type login failed, user login failed, or authentication failure in the Filter Text field. The searches that match the criteria display on the graph and in the User Executed Searches list below the graph.
  3. From the User Executed Searches list, select a search item to open a panel that contains more information about the search.


If the username displays in the panel, whoever ran the search might be looking for an incident where a system user who accidentally typed the password in the username field.