Requestor Name
John Smith
Service Name
User Authentication
Service ID
AUTH-2023-001
Event Header
User login attempt
Event Description
This event captures all user login attempts including success and failure cases. It includes timestamp, IP address, user agent, and authentication method.
User
user_id, email
Tenant
tenant_id, org_name
Stats
attempt_count, last_attempt
Sample Event JSON
{
"event": "user_login",
"timestamp": "2023-05-15T09:30:45Z",
"user": {
"id": "user123",
"email": "user@example.com"
},
"tenant": {
"id": "acme-corp",
"name": "Acme Corporation"
},
"status": "success",
"ip": "192.168.1.100",
"user_agent": "Mozilla/5.0"
}
| Use Case | User authentication monitoring |
| Description | Monitor failed login attempts |
| Use case / Pattern name | Brute force detection |
| Severity | High |
| Threat Description | Multiple failed login attempts from same IP |
| Contact Person | security-team@example.com |
| Pattern | 5+ failed attempts in 5 minutes |
| Log Sample | {"event":"login_failure","user":"test@example.com","ip":"192.168.1.1"} |
| Event Identifier | login_failure |
| Threshold | 5 attempts |
| Time Frame | 5 minutes |
| Alert Action | Block IP temporarily |