# Brute Force Detection Alert Rule (Ghaymah Monitor / Prometheus Format)
groups:
  - name: SecOps_Alerts
    rules:
      - alert: HighLoginFailures_BruteForce
        expr: rate(http_requests_total{path="/api/login", status="401"}[5m]) > 20
        for: 2m
        labels:
          severity: critical
          team: secops
          mitre_tactic: "TA0006 - Credential Access"
          mitre_technique: "T1110 - Brute Force"
        annotations:
          summary: "Potential Brute Force Attack on API Login detected"
          description: "Detected a high rate of failed login attempts (HTTP 401) on /api/login from IP: {{ $labels.client_ip }}. Rate exceeds 20 requests per second over the last 5 minutes."
          mitigation: "Check WAF logs immediately, apply Rate Limiting for the offending IP, and verify if any recent 200 OK responses occurred."