Brute Force via Multiple Failed Logins
This correlation rule detects a high number of failed login attempts for a single user account on a specific endpoint, which may indicate a brute-force attack. For this rule to be effective, it is recommended to set the 'Correlation Entity' to 'User' to group alerts by the targeted user.
SentinelOne
