Question

Background: A Vandaly server is also experiencing brute force attacks into their administrator account. Management would like you to set up monitoring to notify the SOC team if a brute force attack occurs again. Task: Analyze administrator logs that document a brute force attack. Then, create a baseline of the ordinary amount of administrator bad logins and determine a threshold to indicate if a brute force attack is occurring. Upload the administrator login logs. Admin Logins When did the brute force attack occur? Hints: - Look for the name field to find failed logins. - Note that the attack lasted several hours. - Determine a baseline of normal activity and a threshold that would alert if a brute force attack is occurring. - Design an alert to check the threshold every hour and email the SOC team at SOC@vandalay.com if triggered.

          Background: A Vandaly server is also experiencing brute force attacks into their administrator account. Management would like you to set up monitoring to notify the SOC team if a brute force attack occurs again.

Task: Analyze administrator logs that document a brute force attack. Then, create a baseline of the ordinary amount of administrator bad logins and determine a threshold to indicate if a brute force attack is occurring. Upload the administrator login logs.

Admin Logins

When did the brute force attack occur?

Hints:

- Look for the name field to find failed logins.
- Note that the attack lasted several hours.
- Determine a baseline of normal activity and a threshold that would alert if a brute force attack is occurring.
- Design an alert to check the threshold every hour and email the SOC team at SOC@vandalay.com if triggered.

Added by Rachel T.

Question

Please give Ace some feedback