Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detects bruteforce attacks and high-risk logins against Datadog: successful logins from malicious IPs, failed bruteforce attempts from threat-intel-tagged IPs, and successful bruteforce (many failures then at least one success) from any IP.
Strategy
This rule monitors Datadog authentication events where @action is login. It uses three detection paths. First, it identifies successful logins (@http.status_code:200) from IPs tagged in threat intelligence as malicious (@threat_intel.results.intention:malicious). Second, it detects failed login attempts (@http.status_code:403) from IPs tagged as suspicious or malicious, triggering when an IP has at least 10 failures in the evaluation window. Third, it detects successful bruteforce from any IP using the standard bruteforce logic: at least 10 failed attempts and at least 1 successful attempt per client IP. Datadog enriches audit logs with threat intelligence that flags IPs associated with malicious infrastructure, botnets, anonymous proxies, and active attack campaigns.
Triage and response
- Verify if the user account
{{@usr.email}} is aware of the login from IP address {{@network.client.ip}} and determine if credentials may be compromised. - Review
@threat_intel.results.category and intention to understand what type of malicious or suspicious activity is associated with the client IP. - Check
@network.client.geoip for the client IP to see if the location matches expected user locations or known attacker regions. - Examine authentication logs for the same
@network.client.ip to confirm the failed-versus-success pattern and count of attempts. - Investigate actions performed by
{{@usr.email}} after any successful login to identify configuration changes, data access, or privilege escalations. - Force password reset and enable or enforce multi-factor authentication for affected accounts if the activity appears malicious or the account shows signs of compromise.
