Review sign-ins and where they come from

The Anmeldungen (Sign-ins) area shows, from the service's sign-in log, how many sign-ins succeed and how many are refused, at what times and from which networks and countries they come, and reports patterns such as attempts to guess keys or sign-ins from an unusual place. With Herkunft sperren (Block origin), you refuse a suspicious network right away.

Solution overview

The service records every sign-in decision together with its origin: the sign-in method, the outcome, the reason for a refusal, the caller's address, and, through a geolocation database, the country, city, and network operator of that address. From this it computes counts per hour and per origin, and detects unusual patterns. It also applies sign-in rules to every new sign-in and stores what a rule detects as a finding: an attack pattern, or something that's new for a person.

The Anmeldungen area (under Überwachen, Monitoring) has eight tabs:

Tab	Contents
Verlauf (History)	Period (24 hours, 7 days, 30 days, 1 year), five key figures, and a column chart of sign-in decisions by outcome
Wochenmuster (Weekly pattern)	Sign-in decisions by weekday and hour, as a color scale from light (none) to blue (most)
Herkunft (Origin)	Each of your own networks and each external subnet: country, city, network operator, numbers of successful, refused, and challenged sign-ins, number of people, first and last seen
Karte (Map)	Origins on a map: one circle per network with a known location, sized by its number of sign-ins and colored by the share of refusals (blue none, red all). It starts with the whole world; the mouse wheel or Ctrl+Plus/Minus zooms, dragging pans, and Home goes back to the world view. Click a circle to see its row on the Herkunft tab. Your own and private networks have no location; the heading gives their number. A circle where you have no site is worth a closer look
Befunde (Findings)	The stored findings of the sign-in rules with level, rule, time, person, the observed and the usual value, description, and advice
Hinweise (Hints)	Unusual patterns from the last seven days, with origin, description, and advice
Ereignisse (Events)	Every single sign-in decision with address and person, plus the rules it was decided by and the signals (country, network operator, program, second factor); shown only with the `sign-in-events` right
Geodatenbank (Geolocation database)	The files for country/city and network operator with their age and attribution, and their source below

The key figures on the Verlauf tab; clicking one shows what it counts:

Key figure	Meaning
Anmeldungen (Sign-ins)	Successful sign-ins in the period. With the `sign-in-events` right, a click opens the Ereignisse (Events) tab filtered to these sign-ins; without it, the Herkunft (Origin) tab
Abgewiesen (Refused)	Refused sign-ins and wrong second-factor codes; red when there are more of them than successful sign-ins. With the `sign-in-events` right, a click opens the Ereignisse tab filtered to these refusals; without it, the Herkunft tab
Länder (Countries)	Number of countries sign-ins came from; click: the Herkunft (Origin) tab
Befunde (Findings)	Number of findings in the period; red as soon as one calls for action, yellow for findings to ask about. Click: the Befunde tab
Geodatenbank (Geolocation database)	Age of the files in days; yellow when they are out of date, red when the last update failed, gray when there are no files. Click: the Geodatenbank tab

The chart stacks the outcomes Gelungen (Succeeded), Abgewiesen (Refused), Rückfrage (Challenge: a request without credentials, an intermediate step of a Windows sign-in, or a prompt for the second factor), Code richtig (Code correct), and Code falsch (Code wrong).

Steps

Review sign-ins for a period

Open the Anmeldungen area.
Choose the period at the top of the Verlauf tab.

Result: The key figures and the chart cover the period, with one column per hour (24 hours), per day (7 and 30 days), or per week (1 year). A sudden rise in Abgewiesen, or many sign-ins at unusual hours in the Wochenmuster tab, is a reason to look at Befunde, Hinweise, and Herkunft.

Work through the findings of the sign-in rules

Select the Befunde tab. The Stufe (Level) column tells you what to do:

Level	Meaning	Rules
Handeln (Act)	An attack pattern or a key that was passed on	Welle von Fehlversuchen (Wave of failed attempts), Viele Namen von einer Adresse (Many names from one address), Ein Name von vielen Adressen (One name from many addresses), Unmögliche Reise (Impossible travel), Schlüssel aus vielen Netzen (Key from many networks)
Nachfragen (Ask)	Something is new or unusual for the person	Neues Land (New country), Neues Programm (New program), Neuer Netzbetreiber (New network operator), Neues Verfahren (New method), Ungewöhnliche Stunde (Unusual hour)

Compare Beobachtet (Observed), such as a country, with Üblich (Usual): the values the person signed in with during the days of the Vergleichszeitraum (Comparison period). Then read Rat (Advice). Two commands under Weitere (More) show more:
- Ereignisse des Befunds zeigen (Show the finding's events) switches to the Ereignisse tab, filtered to the sign-ins the finding is based on. Remove the Befund … (Finding …) filter above the list to see all of them again.
- Anmeldeprofil der Person … (Sign-in profile of the person …) opens the person's sign-in profile next to them in the Personen und Schlüssel (People and keys) area: for each country, network, network operator, program, method, and hour, how often they signed in that way, with the share and the first and last day. Choose the Zeitraum (Period, 30 days to 3 years) at the top. In the Personen und Schlüssel area, Rechte (Rights) > Anmeldeprofil … shows the same profile.
For Nachfragen, ask the person whether the sign-in was theirs. For Handeln, block the origin (see below) or the person's key in the Personen und Schlüssel area.

Result: A finding stays as it was recorded; the service doesn't re-evaluate it. The Regelversion (Rule version) column names the version of the rule it was recorded under. The Auffällige Anmeldungen (Suspicious sign-ins) card on the Übersicht (Overview) counts the findings added since you last looked at this tab; this is remembered per workstation and Windows user.

Only once there's a habit: Rules about something new only apply once the person has had at least 5 successful sign-ins in the comparison period, and Ungewöhnliche Stunde only from 20. Before that, everything would be new for them.

Find and block a suspicious origin

Select the Hinweise or Herkunft tab. Sort Herkunft by Abgewiesen by clicking the column header.
Select the row of the network.
Select Herkunft sperren … and confirm.

Result: A sign-in rule Herkunft gesperrt: <network> that refuses data access. It applies from the next request from that network on and appears in the Anmelderichtlinie (Sign-in policy) area, where you can change or delete it.

Data access only: The rule blocks data access, not administration, because blocking administration could lock you out. Herkunft sperren does not block your own networks (the Eigenes Netz (Own network) column is filled in); use the sign-in policy for those (see Define the sign-in policy).

Trace the basis of a decision

Select the Ereignisse (Events) tab and the row of the sign-in, for example filtered by Person and Zeitpunkt (UTC) (Time, UTC).
Read Grundlage der Entscheidung (Basis of the decision): the rules the decision was based on, with their effect. “nur Probe” (trial only) marks a rule that is being tried and decided nothing; “aufgehoben durch Ausnahme” (lifted by exception) marks a rule from which an exception exempted the sign-in. Signale (Signals) lists what the decision was based on, with how reliable it is: country and network operator are beobachtet (observed, derived from the address), the program is behauptet (claimed by the program itself).
Choose Weitere (More) > Grundlage der Entscheidung prüfen … (Check basis of decision).

Result: The app asks the service which rules apply today to the same person and origin, and tells you for each rule whether it still stands as it did at sign-in or has changed since. Who changed a rule, and when and how, is shown in the Protokoll (Log) area on the Änderungsprotokoll (Change log) tab.

Set up the geolocation database

Without a geolocation database, the log shows addresses and networks but no country, city, or network operator. The service can download the files itself, or you can hand them over.

Select Weitere (More) > Quelle der Geodatenbank … (Geolocation database source).

Choose the Quelle (Source):

Source	How it is obtained	License and attribution
DB-IP Lite	No account, updated monthly	CC BY 4.0; the attribution “IP Geolocation by DB-IP (https://db-ip.com)” is required
MaxMind GeoLite2	Account ID and license key of a free MaxMind account	GeoLite2 license; the notice “This product includes GeoLite2 data created by MaxMind” is required
Keine (nur Dateien übernehmen) (None, upload files only)	The service downloads nothing; you hand over the files	As required by the source of the files

For MaxMind only: enter the Kontonummer (Account ID) and Lizenzschlüssel (License key).
In Automatisch laden alle … Tage (Download automatically every … days), enter the number of days after which the service downloads the files again on its own (0 to 90; 0 means on command only).
Select Speichern (Save), then Weitere > Geodatenbank jetzt aktualisieren (Update geolocation database now).

Result: A message says whether the geodatabase was updated or was already up to date, and lists the date of each file: Orte (City) for country and city, Netzbetreiber (ASN) for the network operator, each marked “neu übernommen” (newly applied) or “bereits aktuell” (already current). The service uses new files without a restart, and the Geodatenbank tab shows their age and attribution.

Server without internet access: Download the file on another computer (.mmdb, .mmdb.gz, or MaxMind's .tar.gz) and select Weitere > Datei der Geodatenbank übernehmen … (Upload geolocation file). Your answer to the MaxMind question sets the attribution. The service tells from the content whether the file is for country/city or for network operators; upload both.

Notes

Up to a minute behind. The service writes its counts once a minute. Aktualisieren (Refresh) reads the data again.
Times. The chart and the lists show UTC. The Wochenmuster tab counts by the server's clock, because a working day follows local time.
How accurate is the origin? Country and network operator are usually right; the city is often only approximate. A VPN service or a mobile network shows the country of its exit point, not that of the person. The origin is therefore a clue, not proof. What protects access is network rules, keys with an expiration date, and the second factor.
Out-of-date files. Old files lack new address ranges, so the country stays empty or is wrong. The Geodatenbank key figure turns yellow as soon as the service reports the files as out of date. A failed attempt appears under Letzter Fehler (Last error) in the source; the service tries again after six hours.
Privacy. The only outbound traffic is the download of the files; a caller's address never leaves the server. The service stores the MaxMind license key sealed and never returns it; the app only shows whether one is stored. Leave the field empty to keep the stored key, or select Gespeicherten Schlüssel entfernen (Remove stored key) to delete it.
Attribution. If you show countries or cities from the geolocation database in your own reports, credit the source as stated above.
Individual events. The address and person of each sign-in are personal data. The service therefore requires the sign-in-events right, which a rule must name explicitly; admin alone is not enough. Without it, the Ereignisse tab is hidden, and Befunde and Hinweise name no person, no key, and no usual values; Ereignisse des Befunds zeigen and Anmeldeprofil … decline with a note about the right. Counts, origins, patterns, and the findings themselves are available without the right.
Co-determination. Findings to ask about compare a person's sign-ins with their usual ones. In Germany, such an evaluation can be subject to co-determination; clear its use with the people responsible in your organization first (see “Co-determination” in Check sign-in patterns and origins, section “Remarks” (data service documentation)).