{"id":7102,"date":"2026-05-13T15:48:41","date_gmt":"2026-05-13T13:48:41","guid":{"rendered":"https:\/\/logmanager.com\/?post_type=how_to&p=7102"},"modified":"2026-05-27T10:55:09","modified_gmt":"2026-05-27T08:55:09","slug":"alert-firewall-brute-force-attack","status":"publish","type":"how_to","link":"https:\/\/logmanager.com\/cs\/docs\/how-to\/alert-firewall-brute-force-attack\/","title":{"rendered":"Kontextov\u00fd alert pro identifikaci zdroje brute force \u00fatoku na firewall"},"content":{"rendered":"\n

Tento kontextov\u00fd alert poskytuje notifikaci obsahuj\u00edc\u00ed IP adresu \u00fato\u010dn\u00edka a jeho geolokaci v moment\u011b, kdy je detekov\u00e1na aktivita, kter\u00e1 m\u016f\u017ee znamenat brute force \u00fatok.<\/p>\n\n\n\n

\u0160ablona kontextov\u00e9ho alertu je k dispozici ke sta\u017een\u00ed zde:<\/p>\n\n\n

\n
\n St\u00e1hnout \u0161ablonu<\/a>\n <\/div>\n<\/section>\n\n\n

<\/p>\n\n\n\n

Brute force \u00fatok na firewall<\/h2>\n\n\n\n

Brute force \u00fatok na firewall p\u0159edstavuje systematick\u00fd pokus o z\u00edsk\u00e1n\u00ed neopr\u00e1vn\u011bn\u00e9ho p\u0159\u00edstupu do s\u00edt\u011b opakovan\u00fdm a automatizovan\u00fdm zkou\u0161en\u00edm velk\u00e9ho mno\u017estv\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f, dokud nen\u00ed nalezena spr\u00e1vn\u00e1 kombinace (nap\u0159\u00edklad pro VPN nebo SSH p\u0159\u00edstup).<\/p>\n\n\n\n

U\u017eite\u010dnost zasl\u00e1n\u00ed alertu s geolokac\u00ed zdroje \u00fatoku, nap\u0159\u00edklad po 10 ne\u00fasp\u011b\u0161n\u00fdch pokusech z jedn\u00e9 zdrojov\u00e9 IP adresy, spo\u010d\u00edv\u00e1 v rychl\u00e9 detekci incidentu a identifikaci hrozby. Znalost geografick\u00e9ho p\u016fvodu \u00fatoku (nap\u0159. mimo definovan\u00e9 bezpe\u010dn\u00e9 zem\u011b) umo\u017e\u0148uje bezpe\u010dnostn\u00edmu t\u00fdmu okam\u017eit\u011b posoudit riziko a v p\u0159\u00edpad\u011b pot\u0159eby automaticky zablokovat bu\u010f konkr\u00e9tn\u00ed IP adresu, nebo cel\u00fd geografick\u00fd region, \u010d\u00edm\u017e se minimalizuje okno pro \u00fato\u010dn\u00edka a zvy\u0161uje se celkov\u00e1 schopnost rychl\u00e9 reakce na incident. <\/p>\n\n\n\n

Nastaven\u00ed \u0161ablony a alertu<\/h2>\n\n\n\n

Pro z\u00e1jemce jsme p\u0159ipravili ke sta\u017een\u00ed kontextov\u00fd alert. Ten po definovan\u00e9m po\u010dtu neplatn\u00fdch pokus\u016f o p\u0159ihl\u00e1\u0161en\u00ed na firewall z jedn\u00e9 IP adresy za\u0161le alert s IP adresou zdroje potenci\u00e1ln\u00edho \u00fatoku a zemi, ze kter\u00e9 \u00fatok prob\u00edh\u00e1.<\/p>\n\n\n\n

Zde je n\u00e1vod pro import alertu do Logmanageru.<\/p>\n\n\n\n

1. krok: Vytvo\u0159te korela\u010dn\u00ed okno<\/h2>\n\n\n\n

V menu Alerts & Actions<\/strong> v z\u00e1lo\u017ece Correlations<\/strong> vytvo\u0159te nov\u00e9 korela\u010dn\u00ed okno o po\u017eadovan\u00e9 d\u00e9lce (nap\u0159\u00edklad 60s), pojmenujte okno nap\u0159\u00edklad Firewall.<\/p>\n\n\n\n

    \n
  1. <\/li>\n<\/ol>\n\n\n\n
    \"Creating<\/figure>\n\n\n\n

    Ulo\u017ete okno pomoc\u00ed tla\u010d\u00edtka Save<\/strong>.<\/p>\n\n\n\n

    2. krok: Vytvo\u0159te emailovou \u0161ablonu alertu<\/h2>\n\n\n\n

    V sekci Email message templates<\/strong> vytvo\u0159te novou \u0161ablonu a vlo\u017ete do n\u00ed n\u00e1sleduj\u00edc\u00ed \u00fadaje:<\/p>\n\n\n\n

    Name:<\/strong><\/p>\n\n\n\n

    too many login failed from one IP<\/p>\n\n\n\n

    Subject:<\/strong><\/p>\n\n\n\n

    LM Alert – {{name}} \/ {{ msg.failed_remote_ip }}

    Body:
    <\/strong><\/p>\n\n\n\n

    {% extends \"base.html\" %}

    {% block title %}Alert{% endblock %}

    {% block content %}
    <h4>VPN alert - neplatn\u00e9 p\u0159ihl\u00e1\u0161en\u00ed z jedn\u00e9 IP adresy. U\u017eivatel <font color=\"red\"><b>{{ msg.username }}<\/b><\/font> p\u0159ekro\u010dil limit.<\/h4>

    <p>Reason: <b>{{ msg.logdesc }}<\/b><\/p>
    <p>Reason: <b>{{ msg.msg }}<\/b><\/p>
    <p>Reason: <b>{{ msg.reason }}<\/b><\/p>
    <p>Remote IP & Country: <b>{{ msg.failed_remote_ip }}<\/b><\/p>
    <h3>U\u017eivatel: <font color=\"red\"><b>{{ msg.username }}<\/b><\/font><\/h3>

    <hr>

    <h1>Alert message<\/h1>
    Alert name: {{ name }}<br>
    Alert description: {{ description }}<br>

    <h2>Message meta information<\/h2>
    <table style=\"border: 1px solid rgb(0, 102, 153); border-collapse: collapse;\">
        <tr>
            <td style=\"border: 1px solid rgb(0, 102, 153);font-weight: bold;\">Name<\/td>
            <td style=\"border: 1px solid rgb(0, 102, 153);font-weight: bold;\">Value<\/td>
        <\/tr>
        {% for key in meta|sort %}
            {% if key == \"src\" %}
                {% for src in meta.src|sort %}
                    <tr>
                        <td style=\"border: 1px solid rgb(0, 102, 153);\" align=\"left\">{{ key }}.{{ src }}<\/td>
                        <td style=\"border: 1px solid rgb(0, 102, 153);\" align=\"left\">{{ meta.src[src] }}<\/td>
                    <\/tr>
                {% endfor %}
            {% else %}
                <tr>
                    <td style=\"border: 1px solid rgb(0, 102, 153);\" align=\"left\">{{ key|e }}<\/td>
                    <td style=\"border: 1px solid rgb(0, 102, 153);\" align=\"left\">{{ meta[key]|e }}<\/td>
                <\/tr>
            {% endif %}
        {% endfor %}
    <\/table>

    <h2>Message data<\/h2>
    <table style=\"border: 1px solid rgb(0, 102, 153); border-collapse: collapse;\">
        <tr>
            <td style=\"border: 1px solid rgb(0, 102, 153);font-weight: bold;\">Name<\/td>
            <td style=\"border: 1px solid rgb(0, 102, 153);font-weight: bold;\">Value<\/td>
        <\/tr>
        {% for key in msg|sort %}
            <tr>
                <td style=\"border: 1px solid rgb(0, 102, 153);\" align=\"left\">{{ key|e }}<\/td>
                <td style=\"border: 1px solid rgb(0, 102, 153);\" align=\"left\">{{ msg[key]|e }}<\/td>
            <\/tr>
        {% endfor %}
    <\/table>

    {% if dropped > 0 %}
        <div style=\"color: #E81E1E\">Dropped similar messages: {{ dropped }}<\/div>
    {% endif %}
    {% endblock %}<\/code><\/pre>\n\n\n\n
    \"email<\/figure>\n\n\n\n
    Ulo\u017ete \u0161ablonu pomoc\u00ed tla\u010d\u00edtka Save<\/strong>.<\/p>\n\n\n\n
    3. krok: Importujte a nakonfigurujte pravidla pro alert<\/h2>\n\n\n\n
    V z\u00e1lo\u017ece Rules<\/strong> vytvo\u0159te nov\u00fd alert a do XML okna vlo\u017ete k\u00f3d alertu.<\/p>\n\n\n\n
    P\u0159epn\u011bte se do okna Blocks<\/strong>.<\/p>\n\n\n\n
    P\u0159i\u0159a\u010fte alertu n\u00e1zev, nap\u0159: too many login failed from one IP<\/strong> a vlo\u017ete emailovou adresu p\u0159\u00edjemce alertu a p\u0159epn\u011bte alert do stavu Enabled<\/strong>.<\/p>\n\n\n\n
    \"alert<\/figure>\n\n\n\n
    4. krok: Nastavte failed login threshold<\/h2>\n\n\n\n
    V blockly k\u00f3du alertu nastavte po\u017eadovanou hodnotu po\u010dtu nespr\u00e1vn\u00fdch p\u0159ihl\u00e1\u0161en\u00ed, po kter\u00e9 se m\u00e1 alert odeslat.<\/p>\n\n\n\n
    V p\u0159\u00edkladu nastaveno na hodnotu 10.<\/p>\n\n\n\n
    \"Threshold<\/figure>\n\n\n\n
    5. Krok: Vyberte korela\u010dn\u00ed kontext<\/h2>\n\n\n\n
    V blocku Context <\/strong>vyberte va\u0161e d\u0159\u00edve vytvo\u0159en\u00e9 korela\u010dn\u00ed okno<\/p>\n\n\n\n
    \"Blockly<\/figure>\n\n\n\n
    6. krok: P\u0159i\u0159a\u010fte \u0161ablonu alertu<\/h2>\n\n\n\n
    Na konci alertu v blocku send alert<\/strong> vyberte d\u0159\u00edve vytvo\u0159enou e-mailovou \u0161ablonu.<\/p>\n\n\n\n
    \"blockly<\/figure>\n\n\n\n
    V\u00e1\u0161 kontextov\u00fd firewall je p\u0159ipraven<\/h2>\n\n\n\n
    Nyn\u00ed m\u00e1te v\u0161e p\u0159ipraveno pro pos\u00edl\u00e1n\u00ed alert\u016f s IP adresou a geolokac\u00ed \u00fato\u010dn\u00edka.

    <\/p>\n","protected":false},"excerpt":{"rendered":"
    St\u00e1hn\u011bte si \u0161ablonu kontextov\u00e9ho alertu.<\/p>\n","protected":false},"author":7,"featured_media":6969,"parent":0,"template":"","how_to_tag":[47],"class_list":["post-7102","how_to","type-how_to","status-publish","has-post-thumbnail","hentry","how_to_tag-download"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/how_to\/7102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/how_to"}],"about":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/types\/how_to"}],"author":[{"embeddable":true,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/users\/7"}],"version-history":[{"count":2,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/how_to\/7102\/revisions"}],"predecessor-version":[{"id":7158,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/how_to\/7102\/revisions\/7158"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/media\/6969"}],"wp:attachment":[{"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/media?parent=7102"}],"wp:term":[{"taxonomy":"how_to_tag","embeddable":true,"href":"https:\/\/logmanager.com\/cs\/wp-json\/wp\/v2\/how_to_tag?post=7102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}