Security Report

The Security Report provides a consolidated view of security-relevant events — failed logins, account lockouts, suspicious activity, concurrent session violations, and admin elevation events — aggregated from the audit trail, login logs, and security alerts.

'alt' => 'Dashboard overview', 'caption' => 'The default Kiwire dashboard layout', 'screenshot' => true, 'class' => '', ]) Drop images into: public/assets/img/docs/{page}/{filename} --}}

Image not uploaded yet public/assets/img/docs/report-security/overview.png

What It Shows

The Security Report draws from multiple data sources — the audit trail, portal login logs, RADIUS accounting, and security alert events — and presents them in a single view. Use it for periodic security reviews, incident investigation, and ISO 27001 compliance reporting.

Key Metrics

Metric	Description
Failed Login Attempts	Total number of failed admin and WiFi user login attempts in the period. Broken down by total count and unique source IPs.
Accounts Locked	Number of accounts that were automatically locked due to exceeding the maximum failed login threshold.
Concurrent Session Violations	Number of times a session was terminated because the same account logged in from a different device, indicating a potential account-sharing or takeover event.
MFA Verification Failures	Number of failed TOTP code entries during admin login. High counts may indicate a brute-force attempt or a misconfigured authenticator app.
Admin Logins	Total successful and failed admin panel logins for the period.
Superuser Elevation Events	Number of times a superuser account logged in or switched tenant context. All superuser events are flagged with a superuser tag in the audit trail.
Password Changes	Number of admin password changes, including self-service resets and admin-initiated resets.
MFA Changes	Number of MFA enrolments and MFA disablement events. Disablement events also trigger a security alert email.

Charts

• Failed Logins Over Time — line chart showing the daily count of failed login attempts across the period. Spikes are easy to spot visually.
• Top Source IPs — horizontal bar chart of the IP addresses with the most failed login attempts. Useful for identifying brute-force sources to block at the firewall.
• Event Type Breakdown — donut chart of all security events categorised by type (failed login, lockout, session violation, MFA failure, etc.).

Alert Integration

Events that triggered a security alert are marked with a Alert badge in the event timeline. Click the badge to see the alert details and whether the email was delivered. Alert severity levels are:

• Critical — failed login threshold exceeded, tenant data reset
• High — MFA disabled, superuser login
• Medium — account deactivated

Filters

The event timeline at the bottom of the page supports the following filters:

• Date Range — limit events to a specific period
• Event Type — filter to one or more event categories
• Admin — show events for a specific admin account
• IP Address — show events from a specific source IP

Required Permissions

view-report-security