Brute Force Attack - Remote Logon Failures
Detects patterns indicative of automated brute-force attacks against authentication interfaces by counting consecutive remote logon failures for single user accounts. This behavior was observed in the FortiBleed campaign targeting Fortinet devices.
Splunk (SPL)
