Background: A Vandaly server is also experiencing brute force attacks into their administrator account. Management would like you to set up monitoring to notify the SOC team if a brute force attack occurs again.

Task: Analyze administrator logs that document a brute force attack. Then, create a baseline of the ordinary amount of administrator bad logins and determine a threshold to indicate if a brute force attack is occurring.

1. Upload the administrator login logs.

   • Admin Logins

2. When did the brute force attack occur?

   • Hints:
     • Look for the name field to find failed logins.
     • Note the attack lasted several hours.
     • Determine a baseline of normal activity and a threshold that would alert if a brute force attack is occurring. -Design an alert to check the threshold every hour and email the SOC team at SOC@vandalay.com if triggered.