I am in the process of enabling SSO for UCM/IM&P on a UCM 12.5 platform and am looking for ways to monitor failed login SSO sessions. Using Splunk as our our syslog server I am not seeing any logs related to SSO. Is there something perhaps in RTMT that can show this aside from exporting audit/security logs?
