@if ($activities->isEmpty()) @else

@foreach ($activities as $activity) @endforeach

When	Account	Result	Second factor	Source
{{ $activity->login_at?->format('d M Y') ?? '—' }} {{ $activity->login_at?->format('H:i:s') }}	@if ($activity->user) {{ $activity->user->name }} {{ $activity->user->designation ?: $activity->email }} @if ($activity->user->department) · {{ $activity->user->department->name }} @endif @else {{ $activity->email }} No matching account @endif	@if ($activity->successful) @else @if ($activity->failure_reason) {{ $activity->failure_reason }} @endif @endif	@if ($activity->mfa_challenged) @else — @endif	{{ $activity->ip_address ?: '—' }} {{ $activity->user_agent ?: '' }}

@if ($activities->hasPages())

@endif @endif

@if ($recentFailures->isEmpty())

No address has failed three or more times in the last week.

@else

{{ $failure->email }}

Last attempt {{ \Illuminate\Support\Carbon::parse($failure->last_attempt)->diffForHumans() }} · {{ $failure->last_ip }}

Sustained failures from one address may warrant blocking it at the network edge.

@endif

@php $peak = $hourlySpread->max() ?: 1; @endphp

@for ($hour = 0; $hour < 24; $hour++) @php $total = (int) ($hourlySpread[$hour] ?? 0); @endphp

@endfor

00:00 12:00 23:00

Activity outside working hours is worth a second look.

Sign-in telemetry is retained separately from the audit trail so failed attempts that never authenticated — and therefore never touched a patient record — are still visible to administrators.

See failed sign-ins in the audit trail