I have a sensor setup for failed log-ins that triggered twice today. IP is coming from an amazon compute instance in Oregon. My router is setup to block just about any traffic from outside the US but I have it pretty open inside the US.
Is there a away to see successful log-ins or the IP of who is accessing the HA front end? It would be nice to see but im not sure if its logged anywhere that I can pull it with a sensor.