PingFederate Admin Alert: multiple login attempts by locked account in a short time period
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect an unusually high number of login attempts by locked account.
Strategy
Monitor PingFederate logs where a user generates a high number of login attempts by a locked account within a short period. This detection rule aims to identify potential threats early, allowing for timely investigation and mitigation to protect server resources and maintain service availability.
Triage and response
- Analyze the pattern and volume of requests to distinguish between legitimate traffic and potential attacks.
- Investigate the source user
{{@usr.name}} to determine if the activity is malicious. - Implement immediate measures to block or limit the impact of the suspicious activity if confirmed as a threat.
