الملفات
ghaymah-exam-AbdulRhmanAbdu…/q2-incident-response/wazuh-rule.xml
2026-07-27 14:53:15 +03:00

12 أسطر
338 B
XML

<group name="ghaymah_api,">
<rule id="100500" level="10">
<if_sid>5710</if_sid>
<match>/api/v1/auth/login</match>
<string>401</string>
<frequency>8</frequency>
<timeframe>60</timeframe>
<same_source_ip />
<description>Possible Brute Force Attack detected on Ghaymah Auth API</description>
</rule>
</group>