Authentication Methods Distribution

Analyze the distribution of authentication methods. This chart supports several security and compliance objectives, such as:

  • Quickly see what percentage of authentications rely solely on passwords

  • Monitor the proportion of MFA-enabled authentications

  • Identify which user groups need MFA enhancement

  • Identify service accounts or systems using certificate authentication

Visualization: the pie chart visualizes the relative proportion of each authentication methods. Each unique method value becomes a slice; the count of each method determines the size of each slice. The chart positions the largest slices first (clockwise from top).

Pie Chart showing Authentication Methods Distribution

Figure 225. Authentication Methods Distribution


Sample input data:

auth_methodstatustimestampuser
Passwordsuccess2025-08-11T00:01:23Zjohn.doe
MFAsuccess2025-08-11T00:01:24Zjane.smith
Certificatesuccess2025-08-11T00:01:25Zservice.account
Passwordsuccess2025-08-11T00:01:26Zbob.wilson
SSOsuccess2025-08-11T00:01:27Zmary.jones

Query:

logscale
auth_method=* status=success
| groupBy(auth_method, function=count())
| sort(_count, order=desc)

Query breakdown:

  1. Filter to include only events that have a value for the auth_method field – that is, the wildcard * matches any non-empty value.

  2. Filter successful authentications only.

  3. Group all filtered authentication events by unique values in the auth_method field.

  4. Count events in each group by applying the count() function.

  5. Create a field named _count containing the number of authentication events for each method.

  6. Sort the grouped results by the _count field in descending order, ensuring the most common methods appear first.

Configuration:

  1. From the Search page, type your query in the Query Editor → click Run

  2. Choose Pie Chart in the Widget selector

  3. Click the style icon : this opens the Format panel on the side where some properties are already configured by default based on the query result.

  4. Modify the properties to obtain the look and feel of this example widget, as follows:

  5. Toggle Legend on. If there is only one item in the chart, the legend does not show.

  6. Set the position of the legend to Right

  7. Select Show title to display the legend title, then assign a name to the legend title and adjust its size to Small

  8. Change the inherited Colors palette to one of the available custom palettes.

See Pie Chart Property Reference for more customizations of this widget.