Submit complete Ghaymah SecOps exam solution

q2-incident-response/alert-rules.yaml

@@ -0,0 +1,12 @@
+groups:
+  - name: ghaymah-secops-alerts
+    rules:
+      - alert: HighFailedLoginAttempts
+        expr: sum(rate(http_requests_total{status="401", path="/api/v1/auth/login"}[2m])) by (client_ip) > 10
+        for: 1m
+        labels:
+          severity: critical
+          category: security
+        annotations:
+          summary: "Brute Force Attack Detected from IP {{ $labels.client_ip }}"
+          description: "IP {{ $labels.client_ip }} generated over 10 failed login attempts within 2 minutes on Ghaymah API."