3 ms·

Rather than login failures I would monitor login successes. A sharp decrease of successes likely points to some issue, but an increase in login failures might e

Rather than login failures I would monitor login successes. A sharp decrease of successes likely points to some issue, but an increase in login failures might easily be someone trying tons of random credentials on your website (still not ideal, but much harder to act on)

Spivak 7mo ago
Creating this metric/alert is practically a rite of passage for junior ops people who then get paged around 5pm.