Failed Attacks

Failed attacks

Not every attack succeeds. Petra tracks "failed attacks"—attempts that were blocked, that didn't complete, or that didn't result in a full compromise. Viewing failed attacks helps you see what threats are being thrown at your tenant and how well your defenses are holding up. This article explains what failed attacks are and how to use them.

What counts as a failed attack

A failed attack is an attempt to compromise or abuse your environment that did not succeed or did not go all the way. Examples include: repeated failed sign-in attempts (e.g., password spray or brute force that was blocked), phishing emails that were blocked or that users didn't interact with in a way that caused compromise, or malicious links that were blocked by your security controls. Petra aggregates and displays these so you can see patterns—for example, which users are being targeted or which types of attacks are most common. That visibility helps you understand your threat landscape and reinforce defenses where needed.

What you'll see in the failed attacks view

In the reporting hub, the failed attacks section typically shows a list or summary of failed attack events over a chosen time period. You might see counts by type (e.g., failed logins vs. blocked phish), by user, or by date. You can often drill into a specific event to see details: when it happened, which user or resource was targeted, and what blocked it. This level of detail helps you confirm that the event was indeed blocked and gives you context if you need to report to management or customers about attack attempts.

Why failed attacks matter

Failed attacks tell you that someone is trying to get in. Even when they don't succeed, they're a signal of risk. Tracking them helps you: spot campaigns (e.g., many failed logins for the same user), prioritize security awareness or MFA for highly targeted users, and demonstrate to stakeholders that attacks are happening and that your controls are working. Use the failed attacks view alongside your incident list to get the full picture—what got through and what didn't.