Possible brute force attempted against user

This rule is part of a beta feature. To learn more, contact Support.

Goal

Detect when a user attempts to access the OCI console an anomalous amount of times.

Strategy

This rule monitors OCI to detect the 404 error message.

Triage and response

  1. Determine if {{@user.name}} should be attempting to use the identified API calls: {{@evt.name}}.
  2. Contact the user to see if they intended to make these API calls.
  3. If the user did not make the API calls:
    • Rotate the credentials.
    • Investigate which unauthorized API calls might have succeeded throughout the rest of the environment.