الملفات
ghaymah-exam-waleed-secops/q2-incident-response/alert-rules.yaml

13 أسطر
517 B
YAML

groups:
- name: ghaymah-secops-alerts
rules:
- alert: HighFailedLoginAttempts
expr: sum(rate(http_requests_total{status="401", path="/api/v1/auth/login"}[2m])) by (client_ip) > 10
for: 1m
labels:
severity: critical
category: security
annotations:
summary: "Brute Force Attack Detected from IP {{ $labels.client_ip }}"
description: "IP {{ $labels.client_ip }} generated over 10 failed login attempts within 2 minutes on Ghaymah API."