added

q2-attack-simulation/alert-rule.yml

@@ -0,0 +1,69 @@
+# Prometheus Alert Rules — Brute Force Detection
+# Deploy this file as a Prometheus alert rules file and configure AlertManager for notification routing.
+# Reference: incident-response.md for full context and runbook.
+
+groups:
+  - name: security_alerts
+    rules:
+
+      # Rule 1: Rapid failed logins from single IP
+      - alert: BruteForceLoginAttempt
+        expr: |
+          sum(rate(http_requests_total{
+            path="/api/v1/auth/login",
+            status=~"40[13]"
+          }[5m])) by (client_ip) > 10
+        for: 1m
+        labels:
+          severity: critical
+          team: secops
+        annotations:
+          summary: "Brute Force Detected — {{ $labels.client_ip }}"
+          description: |
+            IP {{ $labels.client_ip }} has made more than 10 failed login
+            attempts per minute for 1+ minutes. Block IP and review logs.
+          runbook_url: "internal-security-runbook"
+
+      # Rule 2: Successful login after many failures (credential stuffing)
+      - alert: SuspiciousLoginAfterFailures
+        expr: |
+          (
+            sum(increase(http_requests_total{
+              path="/api/v1/auth/login",
+              status=~"40[13]"
+            }[10m])) by (client_ip) > 20
+          )
+          and
+          (
+            sum(increase(http_requests_total{
+              path="/api/v1/auth/login",
+              status="200"
+            }[10m])) by (client_ip) > 0
+          )
+        for: 0m
+        labels:
+          severity: critical
+          team: secops
+        annotations:
+          summary: "Credential Stuffing Success — {{ $labels.client_ip }}"
+          description: |
+            IP {{ $labels.client_ip }} had 20+ failed logins followed by a
+            successful authentication. Likely brute force or credential stuffing.
+          runbook_url: "internal-security-runbook"
+
+      # Rule 3: Abnormal data export volume
+      - alert: AbnormalDataExport
+        expr: |
+          sum(increase(http_response_bytes_total{
+            path=~"/api/v1/.*/export"
+          }[5m])) by (user_id) > 10485760
+        for: 0m
+        labels:
+          severity: warning
+          team: secops
+        annotations:
+          summary: "Large Data Export — User {{ $labels.user_id }}"
+          description: |
+            User {{ $labels.user_id }} exported more than 10 MB in 5 minutes.
+            Verify this is an authorized operation.
+          runbook_url: "internal-security-runbook"