Correlate failed login activity before alerting

2026-07-29 00:50:14 +02:00
parent 66dcfe09b6
commit 64841d36e7
4 changed files with 104 additions and 26 deletions
--- a/config/ocsentinel-settings.example.json
+++ b/config/ocsentinel-settings.example.json
@@ -1,8 +1,13 @@
 {
-  "warningEventThreshold": 1,
-  "criticalEventThreshold": 20,
-  "warningUniqueIpThreshold": 1,
-  "criticalUniqueIpThreshold": 10,
+  "warningEventThreshold": 10,
+  "criticalEventThreshold": 30,
+  "warningUniqueIpThreshold": 5,
+  "criticalUniqueIpThreshold": 12,
+  "loginBurstWindowMinutes": 15,
+  "warningLoginBurstCount": 5,
+  "criticalLoginBurstCount": 20,
+  "warningSprayAccountCount": 5,
+  "criticalSprayAccountCount": 10,
  "correlationWarningCveThreshold": 1,
  "correlationCriticalCveThreshold": 1,
  "ftpRoots": [