[AlertRule_brute_force]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [AlertRule_brute_force] of settings/audit.ini.
File
settings/audit.ini; override it in settings/override/audit.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Class | threshold | Many failed logins from one network. |
| Event | access.session.login.failed | |
| Threshold | 20 | |
| Window | 300 | |
| GroupBy | actor.ip | |
| Severity | critical | |
| Sinks[] | syslog; mail |
See also
Generated example: audit.ini [AlertRule_brute_force]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/audit.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment