Syslog, Authentication Failure On Device
Login Failures
Large amounts of failed login attempts in a short timeframe can be an key indicator of a brute force attack.
Configuration
severity
critical
Rule Query
sql SELECT * FROM devices,syslog WHERE (devices.device_id = ? AND devices.device_id = syslog.device_id) AND syslog.timestamp >= macros.past_5m AND syslog.msg REGEXP .*authentication failure.*
Last modified
January 27, 2024