groups:
  - name: ghaymah-secops-alerts
    rules:
      - alert: HighFailedLoginAttempts
        expr: sum(rate(http_requests_total{status="401", path="/api/v1/auth/login"}[2m])) by (client_ip) > 10
        for: 1m
        labels:
          severity: critical
          category: security
        annotations:
          summary: "Brute Force Attack Detected from IP {{ $labels.client_ip }}"
          description: "IP {{ $labels.client_ip }} generated over 10 failed login attempts within 2 minutes on Ghaymah API."