MFA Failures
Displays the count of MFA authentication failures caused by service errors or user not being enrolled. A sudden spike in these errors may indicate a service incident requiring immediate investigation and response.
CQL · Falcon Next-Gen SIEMCopy query
#repo=base_sensor #event_simpleName=IdpPolicy*RuleMatch
| in(field=cid, values=[?SelectedCid])
| match(file="aid_master_main.csv", field=[cid, aid])
// Filters
| in(field=MachineDomain, values=[?SelectedDomain])
| case {
IdpPolicyMfaStatus=128 | MfaError:="User Not Enrolled";
IdpPolicyMfaStatus=256 | MfaError:="Service Error";
*;
}
| timeChart(series=MfaError)mfa_failures.yml
CrowdStrike
Monitoring
Identity
Identity
2025-08-26
2025-10-30
