# Prometheus Alert Rules — Brute Force Detection
# Deploy this file as a Prometheus alert rules file and configure AlertManager for notification routing.
# Reference: incident-response.md for full context and runbook.

groups:
  - name: security_alerts
    rules:

      # Rule 1: Rapid failed logins from single IP
      - alert: BruteForceLoginAttempt
        expr: |
          sum(rate(http_requests_total{
            path="/api/v1/auth/login",
            status=~"40[13]"
          }[5m])) by (client_ip) > 10
        for: 1m
        labels:
          severity: critical
          team: secops
        annotations:
          summary: "Brute Force Detected — {{ $labels.client_ip }}"
          description: |
            IP {{ $labels.client_ip }} has made more than 10 failed login
            attempts per minute for 1+ minutes. Block IP and review logs.
          runbook_url: "internal-security-runbook"

      # Rule 2: Successful login after many failures (credential stuffing)
      - alert: SuspiciousLoginAfterFailures
        expr: |
          (
            sum(increase(http_requests_total{
              path="/api/v1/auth/login",
              status=~"40[13]"
            }[10m])) by (client_ip) > 20
          )
          and
          (
            sum(increase(http_requests_total{
              path="/api/v1/auth/login",
              status="200"
            }[10m])) by (client_ip) > 0
          )
        for: 0m
        labels:
          severity: critical
          team: secops
        annotations:
          summary: "Credential Stuffing Success — {{ $labels.client_ip }}"
          description: |
            IP {{ $labels.client_ip }} had 20+ failed logins followed by a
            successful authentication. Likely brute force or credential stuffing.
          runbook_url: "internal-security-runbook"

      # Rule 3: Abnormal data export volume
      - alert: AbnormalDataExport
        expr: |
          sum(increase(http_response_bytes_total{
            path=~"/api/v1/.*/export"
          }[5m])) by (user_id) > 10485760
        for: 0m
        labels:
          severity: warning
          team: secops
        annotations:
          summary: "Large Data Export — User {{ $labels.user_id }}"
          description: |
            User {{ $labels.user_id }} exported more than 10 MB in 5 minutes.
            Verify this is an authorized operation.
          runbook_url: "internal-security-runbook"