Brute Force Sentry for Managed SIEM

* Brute Force Sentry is available to Managed SIEM customers.
* It monitors internet-facing login surfaces including RDP, RD Gateway, and the RDWeb portal on Windows and SSH on Linux.
* The system investigates when a run of failed logons ends in a successful one.
* It reads authentication telemetry from Windows Security events (4624, 4625, 4740, 4776), RD Gateway logs, Linux sshd, and macOS.
* The system normalizes data from these platforms into a single authentication record.
* Detected brute force types include traditional brute force, distributed brute force, spraying, credential stuffing, and username enumeration.
* It correlates events across providers where failed sign-ins and subsequent successes are recorded on different systems.
* The system activates based on the flow of telemetry; if data is missing, it shows as unavailable with a reason.
* A successful compromise example involved 1,700 attempts in 72 seconds against eight accounts on a Remote Desktop Gateway.

The narrative centers on shifting security detection from reactive threshold alerting to proactive, context-aware correlation of low-level authentication telemetry. The core implication is that traditional SIEM reliance on single, generic rules fails to capture the sophisticated, multi-stage tradecraft used by modern attackers who exploit exposed gateway services like RDWeb and RD Gateway. The technical innovation lies in normalizing disparate log formats (Windows events versus SSH lines) into a unified authentication surface, allowing correlation across technologies that traditional tooling struggles with. This addresses the gap where attacks occur *before* an actual network breach—specifically, enumerating valid usernames or testing credentials against publicly exposed portals.
The shift towards surfacing information like targeted accounts and enumeration attempts rather than just failure counts challenges the assumption that privileged accounts are the sole focus of compromise. By focusing on accounts with no apparent ownership or recent access rotation, the system targets the "unknown" assets that attackers seek to exploit for persistence. The high-profile example of 1,700 attempts in 72 seconds underscores the speed at which reconnaissance can transition into access.
The manipulation exists in framing advanced threat detection as a product feature based on observable attack mechanics. By emphasizing that attacks focus on unowned or forgotten accounts rather than just domain admins, the narrative steers attention toward configuration hygiene and exposure management, implicitly suggesting that external posture (exposing gateways) is as critical as internal permissions. The underlying assumption is that visibility into pre-authentication reconnaissance provides an actionable advantage for defenders before lateral movement occurs.
Bridge questions: How does relying on multi-source normalization versus platform-specific rules impact the sensitivity settings for organizations with highly diverse environments? What are the systemic risks if detection relies heavily on correlating external exposure rather than internal behavioral anomalies? If accounts without owners are the primary target, what organizational policies must shift to address accountability and lifecycle management for these shared or forgotten credentials?