Domain-Specific
Security Event Detection
Updated May 31, 2026 · today
Brute-force authentication attempts, anomalous auth failures, privilege escalations, and suspicious access patterns from your auth and audit logs.
Example alert
Exact wording varies — the detector generates titles from the anomaly it finds. This is representative of what an alert looks like when it fires.
How it works
Rule pack matching auth log patterns: SSH brute-force, OAuth failures, sudo escalations, API key abuse, and anomalous login sources. Combines count-over-window thresholds with pattern matching. No learning period.
Availability
Runs on these tiers:
Want to see this detector firing in the live demo?
Open alerts in the sandbox →Related detectors
- Kubernetes Detection
70+ rules for OOMKilled, CrashLoopBackOff, ImagePullBackOff, FailedScheduling, evictions, probe failures, and other Kubernetes failure modes.
- AWS Service Detection
Patterns for RDS, S3, DynamoDB, ECS, EKS, IAM, KMS, Lambda, and 20+ other AWS services. Catches throttling, capacity events, IAM denials, and service-specific failure modes.
- Serverless Detection
Lambda timeouts, cold starts, throttling, init failures, runtime crashes, and concurrency limits across functions.
- Database Detection
Connection pool exhaustion, deadlocks, slow queries, replication lag, schema migration errors, and transaction aborts across Postgres, MySQL, and MongoDB.
- Dependency Detection
Upstream service failures, circuit breaker trips, retry exhaustion, and cascading failures between services.