Excessive failed logons to PCI systems
This rule detects multiple failed authentication attempts for a single user from a specific source IP and host. This behavior can indicate a brute-force attack or password guessing attempt against user accounts.
CQL
