Alert Rules

Model VPN brute-force detection with time windows, MITRE ATT&CK mapping, and correlation logic.

IP, user, device, and license values on this page are anonymized.

IF failed_vpn_login.count >= 10
AND window = 10 minutes
AND distinct(source.ip) >= 3
AND same(user.name)
THEN create incident "VPN_BRUTE_FORCE" severity=high
MITRE: T1110, T1078