Understanding Sonicwall Credential Auditor Event Logs

The Credential Auditor feature in SonicOS enhances security by detecting user credentials that may have been exposed in known data breaches. It compares login attempts against a database of compromised credentials and generates event logs accordingly.

Starting with, SonicOS 7.3.3 and SonicOS 8.2.2, the Credential Auditor is enabled by default.

For a full overview of the feature, refer to:
https://www.sonicwall.com/support/knowledge-base/understanding-and-using-credential-auditor-on-sonicwall-firewalls/kA1VN00000088Bh0AI

Event Message

"Allowed a login attempt by a user whose password was found to have possibly been compromised."

This event indicates that:

• The Credential Auditor identified that the password used in the login attempt matches an entry in its compromised password database.
• The system permitted the attempt to proceed to the authentication mechanism, but this does not indicate a successful login.
•  This event is generated when users authenticate through external mechanisms (e.g., LDAP) and the supplied password is flagged as compromised.

This message does not confirm a successful login. It only indicates that a login attempt was made using a password that the Credential Auditor has identified as potentially compromised.

Note: This event does not indicate an active breach, but rather a high-risk condition.

To block the login of externally authenticated users with a potentially compromised password, please navigate to DEVICE | Users | Settings - Credential Auditor. Under DURING LOGIN, Enable "Block login of externally authenticated users with a compromised password"

Event Message