HTTPS Bruteforce signature - rate limit

[dzimofuk]

Hi,

I am trying to create a custom signature for HTTPS Bruteforce detection (SSL inspection enabled) and I have the following syntax: F-SBID (--name Website.Brute.Force.CustomBody; --protocol TCP; --flow from_server; --pattern "failed because"; --context body; --rate 5,45,limit; --track SRC_IP;)

it is based on server "failed" answers, but even if the rate is 5,45 sometimes alert is triggered even earlier (3,4 attempts) Does anyone know how to mitigate that, or what to change to have more accurate detection.

Thx in advance!

BR Petr Bucek

[ede_pfau]

I think you should use

--flow from_server,reversed;

See post #102544 for example.

[dzimofuk]

Hi,

thx for your answer, but even if i added "reversed" the detection is not working properly.

F-SBID(--name Website.Brute.Force; --protocol TCP; --flow from_server,reversed; --pattern "failed because"; --context body; --rate 6,60,limit; --track SRC_IP;) The behavior is the same like before, (example: even 4 attempts generate 3 alarms etc.)

[dzimofuk]

noone knows?

[ede_pfau]

I'd open a ticket and ask FTNT Service for help. They know for sure.

If so, would be nice to see it here.

[dzimofuk]

Yop, you are right :) I have done it ...thx

BR

Petr