MFA Status Monitoring
Displays Multi-Factor Authentication (MFA) status events over time. Monitor for unexpected spikes in denials, errors, or timeouts that may indicate security threats, system issues, or user experience problems requiring investigation.
CQL · Falcon Next-Gen SIEMCopy query
#repo=base_sensor #event_simpleName=IdpPolicy*RuleMatch
| in(field=cid, values=[?SelectedCid])
| match(file="aid_master_main.csv", field=[cid, aid])
// Filters
| in(field=MachineDomain, values=[?SelectedDomain])
| case {
IdpPolicyMfaStatus=1 | IdpPolicyMfaStatus:="Approved";
IdpPolicyMfaStatus=2 | IdpPolicyMfaStatus:="Denied";
IdpPolicyMfaStatus=32 | IdpPolicyMfaStatus:="Invalid input";
IdpPolicyMfaStatus=64 | IdpPolicyMfaStatus:="Resp. timeout";
IdpPolicyMfaStatus=128 | IdpPolicyMfaStatus:="User not enrolled";
IdpPolicyMfaStatus=256 | IdpPolicyMfaStatus:="Service Error";
IdpPolicyMfaStatus=640 | IdpPolicyMfaStatus:="No authorizer";
}
| timeChart(series=IdpPolicyMfaStatus)mfa_status_monitoring.yml
CrowdStrike
Monitoring
Identity
Identity
2025-10-30
2025-10-30
