Syslog for Authentication
Has anyone be able to setup a syslog for cisco devices that captures fail login attempts?
Forum Discussion
Unfortunately, it looks like Debug, Informational, and Notice syslog events are discarded before they even get to the ES: https://www.logicmonitor.com/support/logicmodules/eventsources/types-of-events/syslog-monitoring
I would get in touch with your CSM to get this put in as a feature request. (Has to be a feature request because it's working as designed, you just need the design changed.)