13 أسطر
517 B
YAML
13 أسطر
517 B
YAML
groups:
|
|
- name: ghaymah-secops-alerts
|
|
rules:
|
|
- alert: HighFailedLoginAttempts
|
|
expr: sum(rate(http_requests_total{status="401", path="/api/v1/auth/login"}[2m])) by (client_ip) > 10
|
|
for: 1m
|
|
labels:
|
|
severity: critical
|
|
category: security
|
|
annotations:
|
|
summary: "Brute Force Attack Detected from IP {{ $labels.client_ip }}"
|
|
description: "IP {{ $labels.client_ip }} generated over 10 failed login attempts within 2 minutes on Ghaymah API."
|