You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Implement a new detection logic to detect bruteforce attemps.
the new detection should be a new celery task scheduled indipendently on celery_beat config. This task should implement two different types of alerts:
This task should be run every 30 minutes
Bruteforce detected on user: {username}
Query logins by aggregating on username: if there is at least MAX_LOGIN_BRUTEFORCE (MAX_TRIES should be configurable in the code) failed logins in the last hour (the task is run every 30 minutes so there is an overlap to detect bruteforce that are longer than running time of the task) a new alert is generated
Bruteforce detected from IP
Query logins by aggregation by source ip: if there is at last MAX_IP_BRUTEFORCE failed logins in the last hour a new alert is generated. This logins could span across multiple usernames, they should be reported on the alert to allow better understanding of the activity
The text was updated successfully, but these errors were encountered:
Implement a new detection logic to detect bruteforce attemps.
the new detection should be a new celery task scheduled indipendently on celery_beat config. This task should implement two different types of alerts:
This task should be run every 30 minutes
Bruteforce detected on user: {username}
Query logins by aggregating on username: if there is at least MAX_LOGIN_BRUTEFORCE (MAX_TRIES should be configurable in the code) failed logins in the last hour (the task is run every 30 minutes so there is an overlap to detect bruteforce that are longer than running time of the task) a new alert is generated
Bruteforce detected from IP
Query logins by aggregation by source ip: if there is at last MAX_IP_BRUTEFORCE failed logins in the last hour a new alert is generated. This logins could span across multiple usernames, they should be reported on the alert to allow better understanding of the activity
The text was updated successfully, but these errors were encountered: