Final Submission for SecOps Exam

q2-red-blue-team/alert-rule.yaml

@@ -0,0 +1,16 @@
+# Brute Force Detection Alert Rule (Ghaymah Monitor / Prometheus Format)
+groups:
+  - name: SecOps_Alerts
+    rules:
+      - alert: HighLoginFailures_BruteForce
+        expr: rate(http_requests_total{path="/api/login", status="401"}[5m]) > 20
+        for: 2m
+        labels:
+          severity: critical
+          team: secops
+          mitre_tactic: "TA0006 - Credential Access"
+          mitre_technique: "T1110 - Brute Force"
+        annotations:
+          summary: "Potential Brute Force Attack on API Login detected"
+          description: "Detected a high rate of failed login attempts (HTTP 401) on /api/login from IP: {{ $labels.client_ip }}. Rate exceeds 20 requests per second over the last 5 minutes."
+          mitigation: "Check WAF logs immediately, apply Rate Limiting for the offending IP, and verify if any recent 200 OK responses occurred."