AN1521
Analytic 1521
Windows
Series of authentication failures (Event ID 4625) targeting the same or similar user accounts over time from one or more remote IPs
WinEventLog:Security
EventCode=4625
[TimeWindow]
Defines the period in which multiple failed attempts are aggregated (e.g., 10 minutes)
[UsernamePattern]
Filter for common account naming conventions, e.g., service accounts or administrator variants
[SourceIPThreshold]
Limit on unique IPs trying to authenticate against a single account
AN1522
Analytic 1522
Linux
Repeated failed SSH login attempts followed by a possible success from the same remote host
linux:syslog
sshd[pid]: Failed password
[PortScope]
Can be tuned to non-standard ports if SSH is moved from default
[UserScope]
Filter high-value or restricted users (e.g., root, service)
[AttemptThreshold]
Number of consecutive failures before flagging (e.g., >5 in 2 minutes)
AN1523
Analytic 1523
macOS
Series of failed logins from loginwindow or sshd with repeated usernames or password prompts
macos:unifiedlog
authd
[AuthMechanism]
Local console vs. SSH vs. remote Apple Admin tools
[FailurePattern]
Use regex to isolate brute force messages among other log noise
AN1524
Analytic 1524
Identity Provider
Multiple failed sign-in attempts from external sources across many users followed by success from the same IP
azure:signinlogs
Sign-in logs
[GeoRiskScore]
Elevate anomalies from uncommon geolocations
[MFAStatus]
Elevate logins missing MFA on high-value accounts
AN1525
Analytic 1525
Network Devices
Login attempt failures over SNMP, Telnet, or SSH interface, often reflected in logs or syslog events
networkdevice:syslog
login failed
[InterfaceType]
Specify monitoring of Telnet/SSH/SNMP for login activity
[FailedAttemptThreshold]
How many failures in short succession should trigger alerting
AN1526
Analytic 1526
SaaS
Password guessing attempts against web-based apps (e.g., Dropbox, Google Workspace) reflected in API or sign-in logs
GCPAuditLogs:login.googleapis.com
Failed sign-in events
[AppContext]
Which SaaS apps should be monitored for brute force attempts
[EmailPattern]
Limit scope to enterprise domains or service accounts