70 أسطر
2.4 KiB
YAML
70 أسطر
2.4 KiB
YAML
# Prometheus Alert Rules — Brute Force Detection
|
|
# Deploy this file as a Prometheus alert rules file and configure AlertManager for notification routing.
|
|
# Reference: incident-response.md for full context and runbook.
|
|
|
|
groups:
|
|
- name: security_alerts
|
|
rules:
|
|
|
|
# Rule 1: Rapid failed logins from single IP
|
|
- alert: BruteForceLoginAttempt
|
|
expr: |
|
|
sum(rate(http_requests_total{
|
|
path="/api/v1/auth/login",
|
|
status=~"40[13]"
|
|
}[5m])) by (client_ip) > 10
|
|
for: 1m
|
|
labels:
|
|
severity: critical
|
|
team: secops
|
|
annotations:
|
|
summary: "Brute Force Detected — {{ $labels.client_ip }}"
|
|
description: |
|
|
IP {{ $labels.client_ip }} has made more than 10 failed login
|
|
attempts per minute for 1+ minutes. Block IP and review logs.
|
|
runbook_url: "internal-security-runbook"
|
|
|
|
# Rule 2: Successful login after many failures (credential stuffing)
|
|
- alert: SuspiciousLoginAfterFailures
|
|
expr: |
|
|
(
|
|
sum(increase(http_requests_total{
|
|
path="/api/v1/auth/login",
|
|
status=~"40[13]"
|
|
}[10m])) by (client_ip) > 20
|
|
)
|
|
and
|
|
(
|
|
sum(increase(http_requests_total{
|
|
path="/api/v1/auth/login",
|
|
status="200"
|
|
}[10m])) by (client_ip) > 0
|
|
)
|
|
for: 0m
|
|
labels:
|
|
severity: critical
|
|
team: secops
|
|
annotations:
|
|
summary: "Credential Stuffing Success — {{ $labels.client_ip }}"
|
|
description: |
|
|
IP {{ $labels.client_ip }} had 20+ failed logins followed by a
|
|
successful authentication. Likely brute force or credential stuffing.
|
|
runbook_url: "internal-security-runbook"
|
|
|
|
# Rule 3: Abnormal data export volume
|
|
- alert: AbnormalDataExport
|
|
expr: |
|
|
sum(increase(http_response_bytes_total{
|
|
path=~"/api/v1/.*/export"
|
|
}[5m])) by (user_id) > 10485760
|
|
for: 0m
|
|
labels:
|
|
severity: warning
|
|
team: secops
|
|
annotations:
|
|
summary: "Large Data Export — User {{ $labels.user_id }}"
|
|
description: |
|
|
User {{ $labels.user_id }} exported more than 10 MB in 5 minutes.
|
|
Verify this is an authorized operation.
|
|
runbook_url: "internal-security-runbook"
|