officecom/oc-sentinel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 21 Wiki Activity

Correlate failed login activity before alerting
All checks were successful
OfficeCom Sentinel Client / validate-client (push) Successful in 24s
Details
OfficeCom Sentinel Client / build-client-windows (push) Successful in 50s
Details

Browse Source
This commit is contained in:
OfficeCom Codex
2026-07-29 00:50:14 +02:00
parent 66dcfe09b6
commit 64841d36e7
4 changed files with 104 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/OCSentinelCli/Configuration.cs
View File

@@ -4,13 +4,23 @@ namespace OCSentinelCli;
internal sealed record ScannerConfiguration
{
public int WarningEventThreshold { get; init; } = 1;
public int WarningEventThreshold { get; init; } = 10;
public int CriticalEventThreshold { get; init; } = 20;
public int CriticalEventThreshold { get; init; } = 30;
public int WarningUniqueIpThreshold { get; init; } = 1;
public int WarningUniqueIpThreshold { get; init; } = 5;
public int CriticalUniqueIpThreshold { get; init; } = 10;
public int CriticalUniqueIpThreshold { get; init; } = 12;
public int LoginBurstWindowMinutes { get; init; } = 15;
public int WarningLoginBurstCount { get; init; } = 5;
public int CriticalLoginBurstCount { get; init; } = 20;
public int WarningSprayAccountCount { get; init; } = 5;
public int CriticalSprayAccountCount { get; init; } = 10;
public int CorrelationWarningCveThreshold { get; init; } = 1;