|Failed authentication for XXXX, Date: 2019-11-26, Time: 13:26:01 AEDT, IP: X.X.X.X, Application: MfO, Method: IWA, Reason: Wrong password|
|Failed authentication for XXXX, Date: 2019-11-22, Time: 15:13:23 AEDT, IP: X.X.X.X, Application: App Launcher, Method: EWS Basic, Reason: Wrong password|
Application: MfO = Mimecast for Outlook
Application: App Launcher = MyApps Webbased portal
Method = IWA ( Intergrated Windows Authentication ) usually from the Mimecast Outlook Add In
Method = EWS Basic ( Used by Domain Authentication to check onprem )
Trackback from your site.